CVE-2026-84374

Received Received - Intake

Laravel Excel Path Traversal Vulnerability

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: GitHub, Inc.

Description

Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\Excel\Files\Disk::copy() method resolves the caller-controlled $destination supplied through Excel::store(), $export->store(), or storeExcel() against the process working directory with realpath() instead of the configured filesystem disk. If the path names an existing writable file, Disk::copy() opens it with fopen() in rb+ mode and uses stream_copy_to_stream(), bypassing Flysystem path confinement and allowing an attacker whose application input controls the export path to overwrite arbitrary existing files with export content. The rb+ behavior creates a non-truncating overwrite and trailing bytes when the new export is shorter, and overwriting an executable PHP file can lead to remote code execution. This issue is fixed in version 3.1.70.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2026-84374

Affected Vendors & Products

Vendor	Product	Version / Range
maatwebsite	excel	From 3.1.8 (inc) to 3.1.70 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability affects Laravel Excel versions 3.1.8 to 3.1.70. The Disk::copy() method uses realpath() to resolve the destination path but does not properly confine it to the configured filesystem disk. An attacker controlling the export path can overwrite existing writable files using fopen() in rb+ mode, leading to potential remote code execution if executable PHP files are overwritten.

Detection Guidance

Check Laravel Excel version with composer show maatwebsite/excel. If version is between 3.1.8 and 3.1.69, the system is vulnerable. Review application code for use of Excel::store(), $export->store(), or storeExcel() with user-controlled paths.

Impact Analysis

An attacker could exploit this to overwrite critical files on your system, including executable PHP files, which may lead to remote code execution. This could allow unauthorized access, data theft, or system compromise depending on the overwritten files.

Compliance Impact

This vulnerability could lead to unauthorized file overwrites, potentially exposing or modifying sensitive data. For GDPR, this may result in unauthorized data access or processing, violating integrity and confidentiality principles. For HIPAA, it could allow unauthorized modification of protected health information files, compromising data integrity and security.

Mitigation Strategies

Upgrade Laravel Excel to version 3.1.70 or later immediately. Audit all code paths using Excel export functions to ensure destination paths are not user-controlled. Restrict write permissions on directories containing PHP files.

Hi! I’m here to help you understand CVE-2026-84374. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70