CVE-2020-7790 Arbitrary File Read

Medium 5.3 Published 11 Dec 2020 Updated 16 Sep 2024

An attacker can read arbitrary files by specifying a file:// URL, leading to information disclosure in applications using this library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2020-7790?

CVE-2020-7790 is a medium-severity path traversal vulnerability in spatie/browsershot, published on 11 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

This affects the package spatie/browsershot from 0.0.0. By specifying a URL in the file:// protocol an attacker is able to include arbitrary files in the resultant PDF.

Weakness: CWE-22

Which versions are affected by CVE-2020-7790?

2 open source packages ship an affected version, including spatie/browsershot. It affects 1 product.

Package	Affected	Fixed in
`spatie/browsershot` Packagist	All versions	`3.40.1`
`spatie/browsershot` Packagist	All versions	`3.40.1`

Products include Spatie Browsershot.

How do I fix CVE-2020-7790?

Upgrade spatie/browsershot to 3.40.1 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2020-7790 being exploited?

There is no known exploitation of CVE-2020-7790 in the wild and no public exploit code.

Sources

Also known as GHSA-rv74-mh27-4jpv.