Patchfirst
Patchfirst
ChainPackagist:spatie/browsershot

spatie/browsershot: fix bypasses (2022–2025)

6 CVEs over 5 generations, 25 Nov 2022 to 5 Feb 2025.

Family tree

Left to right by publication date.Oldest first. Select a CVE to open it.
  1. CVE-2022-4170625 Nov 2022 First in the chain
  2. CVE-2022-4398425 Nov 2022 next fix after CVE-2022-41706
  3. CVE-2024-2154413 Dec 2024 No direct link to an earlier CVE
  4. CVE-2024-2154718 Dec 2024 next fix after CVE-2024-21544related to CVE-2022-43984
  5. CVE-2024-2154920 Dec 2024 bypassed the fix for CVE-2024-21544related to CVE-2024-21547and 1 more
  6. CVE-2025-10265 Feb 2025 bypassed the fix for CVE-2024-21549
Nov 2022Jan 2023OctOct 2024Jan 2025 CVE-2024-21544 → CVE-2024-21547: Next fix in the same package (high confidence)CVE-2024-21544 → CVE-2024-21549: bypassed the fix (high confidence)CVE-2024-21547 → CVE-2024-21549: related (high confidence)CVE-2024-21549 → CVE-2025-1026: bypassed the fix (high confidence)CVE-2022-41706 → CVE-2022-43984: Next fix in the same package (medium confidence)CVE-2022-43984 → CVE-2024-21547: related (medium confidence)CVE-2022-43984 → CVE-2024-21549: related (medium confidence) CVE-2022-41706 25 Nov 2022 CVE-2022-43984 25 Nov 2022 CVE-2024-21544 13 Dec 2024 CVE-2024-21547 18 Dec 2024 CVE-2024-21549 20 Dec 2024 CVE-2025-1026 5 Feb 2025 Nov 2022Jan 2023JulJan 2024OctJan 2025 CVE-2024-21544 → CVE-2024-21547: Next fix in the same package (high confidence)CVE-2024-21544 → CVE-2024-21549: bypassed the fix (high confidence)CVE-2024-21547 → CVE-2024-21549: related (high confidence)CVE-2024-21549 → CVE-2025-1026: bypassed the fix (high confidence)CVE-2022-41706 → CVE-2022-43984: Next fix in the same package (medium confidence)CVE-2022-43984 → CVE-2024-21547: related (medium confidence)CVE-2022-43984 → CVE-2024-21549: related (medium confidence) CVE-2022-41706 25 Nov 2022 CVE-2022-43984 25 Nov 2022 CVE-2024-21544 13 Dec 2024 CVE-2024-21547 18 Dec 2024 CVE-2024-21549 20 Dec 2024 CVE-2025-1026 5 Feb 2025
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low

CVEs in this family

Table view of the tree
CVEPublishedTitleLinked fromPriority
CVE-2022-41706 25 Nov 2022 Browsershot 3.57.2 - Server Side XSS to LFR via URL · fixed in 3.57.3 First in chain 15.9
CVE-2022-43984 25 Nov 2022 Browsershot 3.57.3 - Server Side XSS to LFR via HTML · fixed in 3.57.4 CVE-2022-41706 · Next fix in the same package · Medium 15.9
CVE-2024-21544 13 Dec 2024 Versions of the package spatie/browsershot before 5.0.1 are vulnerable to Improper Input Validation due to improper… · fixed in 5.0.1 First in chain 15.5
CVE-2024-21547 18 Dec 2024 Versions of the package spatie/browsershot before 5.0.2 are vulnerable to Directory Traversal due to URI normalisation… · fixed in 5.0.2 CVE-2024-21544 · Next fix in the same package · High 17.5
CVE-2024-21549 20 Dec 2024 Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper… · fixed in 5.0.3 CVE-2024-21544 · bypassed the fix · High 15.8
CVE-2025-1026 5 Feb 2025 Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation due to improper… · fixed in 5.0.5 CVE-2024-21549 · bypassed the fix · High 15.2
↑ ↓ chooseEnter openEsc close