CVE-2025-1022
Published: 05 February 2025
Summary
CVE-2025-1022 is a high-severity Improper Input Validation (CWE-20) vulnerability in Snyk (inferred from references). Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-10 (Software Usage Restrictions) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-1022 is an Improper Input Validation vulnerability (CWE-20) affecting versions of the PHP package spatie/browsershot prior to 5.0.5. The issue resides in the setHtml function, which is invoked by Browsershot::html(), where user-supplied HTML content lacks proper validation to block file URI schemes. Attackers can bypass intended restrictions by omitting slashes in file URIs, such as using "file:../../../../etc/passwd" instead of blocked forms like "file://" or "file:/", allowing arbitrary file reads during HTML rendering.
Remote attackers require no privileges or user interaction to exploit this over the network with low complexity, as indicated by the CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). By injecting malicious HTML into a Browsershot::html() call, they can achieve high-impact confidentiality loss through local file disclosure, such as reading sensitive system files, alongside low integrity impact.
Mitigation involves upgrading to spatie/browsershot version 5.0.5 or later, where fixes are implemented in commits like bcfd608b264fab654bf78e199bdfbb03e9323eb7 and e3273974506865a24fbb5b65b534d8d4b8dfbf72. Security advisories from Snyk (SNYK-PHP-SPATIEBROWSERSHOT-8496747) detail the vulnerability and proof-of-concept examples available in related GitHub gists.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-0240
Vulnerability details
Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html(), which can be bypassed by omitting the slashes in the file URI (e.g., file:../../../../etc/passwd). This is due to missing validations…
more
of the user input that should be blocking file URI schemes (e.g., file:// and file:/) in the HTML content.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper input validation in public-facing PHP library enables remote arbitrary local file read (e.g. /etc/passwd) via crafted file: URIs in HTML rendering.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of user-supplied HTML inputs to Browsershot::html() to block malicious file URI schemes like 'file:../../../../etc/passwd'.
Mandates timely identification, reporting, and patching of the improper input validation flaw in spatie/browsershot versions before 5.0.5.
Enforces software usage restrictions to authorize only non-vulnerable versions of spatie/browsershot (5.0.5 or later) and block exploitable ones.