{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3amaatwebsitelaravel_excel/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:maatwebsite:laravel_excel:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-84374"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Laravel Excel (\u003e= 3.1.8, \u003c 3.1.70)"],"_cs_severities":["high"],"_cs_tags":["path-traversal","rce","php"],"_cs_type":"advisory","_cs_vendors":["Maatwebsite"],"content_html":"\u003cp\u003eLaravel Excel (maatwebsite/excel) versions 3.1.8 through 3.1.69 contain a path traversal vulnerability in the \u003ccode\u003eExcel::store()\u003c/code\u003e functionality. The library improperly resolves the destination path against the process working directory rather than the configured Flysystem disk. If the provided path resolves to an existing file, the library utilizes \u003ccode\u003efopen()\u003c/code\u003e to write the export data directly to the filesystem, bypassing standard security abstractions.\u003c/p\u003e\n\u003cp\u003eAn attacker able to control the \u003ccode\u003e$filePath\u003c/code\u003e argument passed to \u003ccode\u003eExcel::store()\u003c/code\u003e can force the application to overwrite critical system files, including web-accessible scripts like front controllers or cached views. Since the CSV and HTML writers include cell content verbatim, this overwrite primitive allows for the injection of malicious code. Exploitation requires the existing file to be writable by the PHP user and for the application to pass unsanitized input to the library.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in an arbitrary file overwrite of any file accessible to the PHP process. When the target is a web-accessible script, this leads to Remote Code Execution (RCE). Applications delegating file naming or path construction to user request input are at high risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to Laravel Excel version 3.1.70 or later, which ensures all writes are routed through the configured Flysystem disk.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately possible, implement server-side validation to reject absolute paths and directory traversal segments (e.g., \u003ccode\u003e..\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eEnforce strict filename sanitization using \u003ccode\u003ebasename()\u003c/code\u003e on all user-supplied input before passing the value to \u003ccode\u003eExcel::store()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAudit application code for instances where user input flows into the path argument of \u003ccode\u003eExcel::store()\u003c/code\u003e or \u003ccode\u003e-\u0026gt;storeExcel()\u003c/code\u003e calls.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-08T21:53:36Z","date_published":"2026-09-08T21:53:36Z","id":"https://feed.craftedsignal.io/briefs/2026-09-laravel-excel-traversal/","summary":"The Laravel Excel library (v3.1.8-v3.1.69) fails to properly sanitize the destination path in the store() method, allowing an attacker to overwrite arbitrary files writable by the PHP process via path traversal, leading to potential RCE.","title":"Laravel Excel Arbitrary File Overwrite via Path Traversal","url":"https://feed.craftedsignal.io/briefs/2026-09-laravel-excel-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:maatwebsite:laravel_excel:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}