Path Traversal in exceljs-hardened Workbook.addImage

Executive Summary

CVE-2026-78208 is a path traversal vulnerability in the exceljs-hardened library before version 5.0.0. It occurs in the Workbook.addImage() function where user-supplied file paths are not properly validated before being passed to fs.readFile(). Attackers can use path traversal sequences like ../ to read any file accessible to the Node.js process and embed it in a generated workbook.

Useful 0 Not Useful 0

Detection Guidance

Check if your system uses exceljs or exceljs-hardened versions vulnerable to CVE-2026-78208 (up to 4.4.0). Inspect code for Workbook.addImage() calls with user-supplied filenames. Use commands like 'npm list exceljs' or 'npm list exceljs-hardened' to check installed versions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to read sensitive files on the system where the Node.js process has access. If exploited, it could lead to unauthorized data exposure, including system files, configuration files, or other confidential information. The impact is high due to the lack of required privileges or user interaction for exploitation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to violations of data protection regulations like GDPR and HIPAA by enabling unauthorized access to sensitive personal or health information. Organizations using vulnerable versions may face compliance breaches, legal penalties, and reputational damage due to data exposure.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to exceljs-hardened version 5.0.0 or later. If using exceljs directly, avoid passing user input to Workbook.addImage() without validation. Implement path sanitization using safeJoin() or similar methods to prevent traversal sequences.

Useful 0 Not Useful 0