CVE-2026-126779

{
  "etk_id": "ETK-2026-4205",
  "cve_id": "CVE-2026-126779",
  "display_id": "CVE-2026-126779",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-123773",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Local file read in spatie browsershot",
  "summary": "Spatie Browsershot versions 2.2.0 through versions before 5.5.0 can expose files readable by the server during PDF or screenshot generation. An attacker can cause local file contents to appear in generated output when they can supply HTML processed through setHtml().",
  "mitigation": "Upgrade browsershot to version 5.5.0 or later. Until upgraded, do not pass untrusted HTML to setHtml().",
  "vendor": "spatie",
  "product": "browsershot",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.2.0, < 5.5.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "5.5.0"
      ],
      "package_name": "browsershot",
      "purl": null
    }
  ],
  "cwes": [
    73
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 12.9454022,
  "t0_at": "2026-11-11T18:41:10.254000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-11T19:32:27.639397+00:00",
      "days": 0.03561788653935185,
      "is_lower_bound": false,
      "measured_at": "2026-11-11T18:41:10.254000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-11T18:41:10.254000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-11T18:41:10.254000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-126779"
    }
  }
}