Laravel Excel Arbitrary File Overwrite via Path Traversal

Laravel Excel (maatwebsite/excel) versions 3.1.8 through 3.1.69 contain a path traversal vulnerability in the Excel::store() functionality. The library improperly resolves the destination path against the process working directory rather than the configured Flysystem disk. If the provided path resolves to an existing file, the library utilizes fopen() to write the export data directly to the filesystem, bypassing standard security abstractions.

An attacker able to control the $filePath argument passed to Excel::store() can force the application to overwrite critical system files, including web-accessible scripts like front controllers or cached views. Since the CSV and HTML writers include cell content verbatim, this overwrite primitive allows for the injection of malicious code. Exploitation requires the existing file to be writable by the PHP user and for the application to pass unsanitized input to the library.

Impact

Successful exploitation results in an arbitrary file overwrite of any file accessible to the PHP process. When the target is a web-accessible script, this leads to Remote Code Execution (RCE). Applications delegating file naming or path construction to user request input are at high risk.

Recommendation

• Upgrade to Laravel Excel version 3.1.70 or later, which ensures all writes are routed through the configured Flysystem disk.
• If upgrading is not immediately possible, implement server-side validation to reject absolute paths and directory traversal segments (e.g., ..).
• Enforce strict filename sanitization using basename() on all user-supplied input before passing the value to Excel::store().
• Audit application code for instances where user input flows into the path argument of Excel::store() or ->storeExcel() calls.