This affects the package spatie/browsershot from 0.0.0. By specifying a URL in the file:// protocol an attacker is able to include arbitrary files in the resultant PDF.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| spatie/browsershot(Packagist) | 0 | 3.40.1 | N/A |
CVSS Metrics
