-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| spatie/browsershot | composer | < 3.57.3 | 3.57.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the lack of validation for 'file://' URLs in the URL handling logic. The GitHub patch shows the vulnerability was addressed by adding a 'file://' check specifically in the setUrl method (via Helpers::stringStartsWith). Since this was the only location where URL validation was missing in the vulnerable version, and the CVE description explicitly mentions the Browsershot::html method's failure to validate content containing 'file://' URLs (which ultimately get passed to setUrl), this function is the clear entry point for the vulnerability. The direct modification to this method in the patch confirms its role in the vulnerability.