Composer spatie/browsershot has 10 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2020-7790 | browsershot local file inclusion vulnerability | medium | 5.3 | <3.40.1 | 3.40.1 |
| CVE-2024-21547 | Spatie Browsershot Directory Traversal vulnerability | high | 7.5 | <5.0.2 | 5.0.2 |
| CVE-2022-43983 | Browsershot vulnerable to Cross-Site Scripting (XSS) | medium | 6.1 | <3.57.3 | 3.57.3 |
| CVE-2022-41706 | Browsershot does not validate URL protocols passed to Browsershot URL method | high | 8.2 | <3.57.3 | 3.57.3 |
| CVE-2022-43984 | Browsershot version 3.57.3 vulnerable to improper input validation | medium | 6.1 | <3.57.4 | 3.57.4 |
| CVE-2024-21549 | Browsershot Improper Input Validation vulnerability | high | 8.6 | <5.0.3 | 5.0.3 |
| CVE-2024-21544 | Browsershot Local File Inclusion | high | 8.6 | <5.0.1 | 5.0.1 |
| CVE-2025-1026 | Browsershot Local File Inclusion | high | 8.6 | <5.0.5 | 5.0.5 |
| CVE-2025-1022 | Browsershot Path Traversal | high | 8.2 | <5.0.5 | 5.0.5 |
| CVE-2025-3192 | Browsershot Server-Side Request Forgery (SSRF) via setURL() Function | high | 8.2 | <=5.0.3 | – |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# PHP projects (recommended) composer require --dev phpwarden/phpwarden # then vendor/bin/phpwarden deps composer.lock # or, without Composer pipx install phpwarden && phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked