EUVD-2026-69706Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network vector applies as path reaches server via HTTP; AC:H reflects requirement for existing writable target file; PR:L for authenticated app-level access controlling export destination; C/I/A:H via RCE chain through PHP file overwrite.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\Excel\Files\Disk::copy() method resolves the caller-controlled $destination supplied through Excel::store(), $export->store(), or storeExcel() against the process working directory with realpath() instead of the configured filesystem disk. If the path names an existing writable file, Disk::copy() opens it with fopen() in rb+ mode and uses stream_copy_to_stream(), bypassing Flysystem path confinement and allowing an attacker whose application input controls the export path to overwrite arbitrary existing files with export content. The rb+ behavior creates a non-truncating overwrite and trailing bytes when the new export is shorter, and overwriting an executable PHP file can lead to remote code execution. This issue is fixed in version 3.1.70.
AnalysisAI
Path traversal in Laravel Excel (versions 3.1.8-3.1.69) allows authenticated low-privilege users to overwrite arbitrary existing files on the server by supplying a crafted destination path to Excel::store(), $export->store(), or storeExcel(). The vulnerable Disk::copy() method resolves caller-controlled paths via realpath() against the process working directory, then opens matched files directly with fopen(rb+) and stream_copy_to_stream(), bypassing Flysystem's path confinement entirely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all three of the following conditions simultaneously: (1) the application exposes a code path where attacker-controlled input reaches the `$filePath` parameter of `Excel::store()`, `$export->store()`, or `storeExcel()` - applications that hardcode or sanitize this path are not exploitable via this vector; (2) `realpath()` must resolve the attacker-supplied path to an existing file writable by the web server process, meaning a non-existent destination is handled safely by the `else` branch; (3) for RCE specifically, the overwritten file must be a PHP file accessible via the web server - overwriting non-PHP files results in file corruption only. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) captures the threat accurately: high complexity (AC:H) reflects the precondition that an existing writable file must reside at the resolved path; low privileges (PR:L) reflect that an authenticated application user must control the export destination parameter. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Laravel Excel 3.1.70, which is confirmed patched via the official release at https://github.com/SpartnerNL/Laravel-Excel/releases/tag/3.1.70 and commit b5cafdfcf7ec63924e83303763be8fcae340f70b. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Immediately identify and document all systems running Laravel Excel versions 3.1.8-3.1.69; review user access to Excel export functions and implement role-based restrictions to limit usage to trusted, essential users only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today