AIKIDO-2026-300154
maatwebsite/excel is vulnerable to Path Traversal
75
High Risk
This Affects:
maatwebsite/excelTL;DR
Laravel Excel resolves the export destination path passed to the store APIs against the process working directory instead of the configured filesystem disk. When that path resolves to an existing file, Disk::copy writes to it with fopen in rb+ mode, bypassing Flysystem disk-root confinement and traversal checks. Applications that pass user controlled export paths can be made to overwrite existing files writable by the PHP process with partly user controlled content, which can lead to code execution when an executable file is overwritten. The fix routes all writes through the disk put method so the configured disk root is always enforced.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application passes an unsanitized user controlled value as the export path to the store APIs.
Background info
maatwebsite/excel is vulnerable to Path Traversal in versions 3.1.8 - 3.1.69.
How to fix this
Upgrade the maatwebsite/excel library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant