CVE-2022-41706

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-41706
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-41706.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-41706
Aliases
Published
2022-11-25T00:00:00Z
Modified
2026-08-12T03:51:47Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CVSS Calculator
Summary
Browsershot 3.57.2 - Server Side XSS to LFR via URL
Details

Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the URL protocol passed to the Browsershot::url method.

Database specific 
{
    "cna_assigner": "Fluid Attacks",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41706.json"
}
References

Affected packages

Git / github.com/spatie/browsershot

Affected ranges

Type
GIT
Repo
https://github.com/spatie/browsershot
Events
Introduced
7125719979b7de1257bbf699ff1d3bff3125b228
Last Affected
7125719979b7de1257bbf699ff1d3bff3125b228
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:spatie:browsershot:3.57.2:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "3.57.2"
        },
        {
            "last_affected": "3.57.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_STRING"
    ]
}

Affected versions

3.*
3.57.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-41706.json"