CVE-2025-3192: Browsershot Server-Side Request Forgery (SSRF) via setURL() Function

April 4, 2025

Versions of the package spatie/browsershot from 0.0.0 to 5.0.3 are vulnerable to Server-side Request Forgery (SSRF) in the setUrl() function due to a missing restriction on user input, enabling attackers to access localhost and list all of its directories.

References

gist.github.com/JunMing27/651998a34d57fbf71ff9d25386f1da0f
github.com/advisories/GHSA-qw64-6vcc-8ghx
github.com/spatie/browsershot
nvd.nist.gov/vuln/detail/CVE-2025-3192
security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8548015

Code Behaviors & Features

Detect and mitigate CVE-2025-3192 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →