Laravel Excel CVE-2026-84374

Exploitation requires all three of the following conditions simultaneously: (1) the application exposes a code path where attacker-controlled input reaches the $filePath parameter of Excel::store(), $export->store(), or storeExcel() - applications that hardcode or sanitize this path are not exploitable via this vector; (2) realpath() must resolve the attacker-supplied path to an existing file writable by the web server process, meaning a non-existent destination is handled safely by the else branch; (3) for RCE specifically, the overwritten file must be a PHP file accessible via the web server - overwriting non-PHP files results in file corruption only. CVSS PR:L confirms at least application-level authenticated access is required. The rb+ non-truncating behavior means shorter exports leave trailing artifact bytes, which may alert defenders monitoring file integrity.

The CVSS 7.5 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) captures the threat accurately: high complexity (AC:H) reflects the precondition that an existing writable file must reside at the resolved path; low privileges (PR:L) reflect that an authenticated application user must control the export destination parameter. No EPSS score or CISA KEV listing appears in the input data, and no standalone POC is confirmed - exploitation probability is therefore unquantified but the commit diff makes the vulnerability straightforward to reproduce for a skilled attacker. The RCE path is realistic only when PHP files are writable by the web server process and the application surfaces the export path as user input, conditions that are common in poorly hardened deployments. Even a mid-sized municipal IT team in mielec running a Laravel SaaS application where export paths flow through user-submitted form fields should treat this as urgent, since the exploitation chain from path traversal to code execution is direct and the fix is a one-line removal. The C:H and A:H ratings are indirect (achieved through overwriting PHP files leading to RCE), not through direct data exfiltration, but they are well-supported once the I:H condition is met.

An authenticated user submits a crafted export path such as ../../public/index.php through an application feature that passes the destination to Excel::store(). Laravel Excel's Disk::copy() resolves the traversal via realpath(), finds the existing index.php, and overwrites it with export file content containing embedded PHP code. A subsequent GET request to the application root executes the injected PHP payload as the web server process.