High, CVSS 7.5PackagistAmendedPublished
Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path
CVE-2026-84374 · GHSA-c7r6-vx3h-w5g2
- Affected
- Packagist maatwebsite/excel >= 3.1.8, < 3.1.70
- Fixed in
- 3.1.70· Vendor fix available
- Issue
- Excel::store() resolved the destination path against the process working directory rather than the configured filesystem disk. When that path resolved to an existing file, the export was written straight to it with fopen(), bypassing the disk entirely. An application that passes a user-controlled value as the export path could therefore be made to overwrite an arbitrary existing file that the PHP process can write to, with content the user controls. Details Maatwebsite\Excel\Files\Disk::copy() contained two paths: $destination is the $filePath argument given to Excel::store(), $export-store() or -storeExcel(). realpath() resolves it against the current working directory — public/ for a typical web request — not against the disk root. On a hit, the write went directly to the filesystem and never reached Flysystem, which would otherwise have rejected ../ traversal and confined absolute paths to the disk root. The disk argument was effectively ignored for those paths, including…
Recommended action: Upgrade to 3.1.70 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.