CVE-2024-21549

HighCVSS 8.6/10Last modified Aug 6, 2026

Description

Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An attacker can exploit this vulnerability by utilizing view-source:file://, which allows for arbitrary file reading on a local file. **Note:** This is a bypass of the fix for [CVE-2024-21544](https://security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8496745).

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Dec 20, 2024
Last modified: Aug 6, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-21554.3A vulnerability was found in SourceCodester Best POS Management System 1.0 and classified as problematic. This issue affects some unknown pr CVE-2024-215506.1SteVe is an open platform that implements different version of the OCPP protocol for Electric Vehicle charge points, acting as a central ser CVE-2024-215529.8All versions of `SuperAGI` are vulnerable to Arbitrary Code Execution due to unsafe use of the ‘eval’ function. An attacker could induce the CVE-2024-21569.8A vulnerability was found in SourceCodester Best POS Management System 1.0. It has been classified as critical. Affected is an unknown funct CVE-2024-215718.1Snyk has identified a remote code execution (RCE) vulnerability in all versions of Code Agent. The vulnerability enables an attacker to exec CVE-2024-2157410.0The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom CVE-2024-215758.6ComfyUI-Impact-Pack is vulnerable to Path Traversal. The issue stems from missing validation of the `image.filename` field in a POST request CVE-2024-2157610.0ComfyUI-Bmad-Nodes is vulnerable to Code Injection. The issue stems from a validation bypass in the BuildColorRangeHSVAdvanced, FilterContou CVE-2024-2157710.0ComfyUI-Ace-Nodes is vulnerable to Code Injection. The ACE_ExpressionEval node contains an eval() in its entrypoint function that accepts ar CVE-2024-215834.1Versions of the package github.com/gitpod-io/gitpod/components/server/go/pkg/lib before main-gha.27122; versions of the package github.com/g CVE-2024-215846.1Pleasanter 1.3.49.0 and earlier contains a cross-site scripting vulnerability. If an attacker tricks the user to access the product with a s CVE-2024-215855.9An Improper Handling of Exceptional Conditions vulnerability in BGP session processing of Juniper Networks Junos OS and Junos OS Evolved all