EUVD-2026-64683
GHSA-vw3h-4fh6-vvqq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable with no privilege requirement or user interaction at the library level; impact is confidentiality-only as the flaw enables arbitrary file reads but not writes or service disruption.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
exceljs-hardened before 5.0.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook.
Articles & Coverage 1
AnalysisAI
Path traversal in exceljs-hardened before 5.0.0 allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying crafted paths to the Workbook.addImage() function, which performs no input validation before passing the value to Node.js file system APIs. Any Node.js application that exposes this function to user-controlled input is at risk of exposing secrets, credentials, configuration files, and any other content readable by the process. No public exploit has been identified at time of analysis; vendor-released patch is available as version 5.0.0.
Technical ContextAI
CWE-73 (External Control of File Name or Path) applies when externally-supplied data is used to construct a file path without adequate sanitization. The Workbook.addImage() method in exceljs-hardened accepts a filename argument and passes it directly to Node.js filesystem APIs, reading the file content and embedding it into the generated .xlsx workbook. The vulnerable logic is traceable to the upstream exceljs v4.4.0 codebase at lib/doc/workbook.js (lines 142-147) and lib/xlsx/xlsx.js (lines 421-429), as cited in the references. An attacker can supply traversal sequences such as '../../../etc/passwd' or absolute paths such as '/run/secrets/api_key' to cause the process to read and embed the target file. The library is a Node.js package and the affected CPE is cpe:2.3:a:exceljs:exceljs:*:*:*:*:*:*:*:*, though the CVE specifically concerns the exceljs-hardened fork maintained by mateocallec.
RemediationAI
Upgrade to exceljs-hardened version 5.0.0 or later, which resolves this vulnerability per the GitHub security advisory GHSA-m8mg-8574-gm3m at https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-m8mg-8574-gm3m. If an immediate upgrade is not feasible, the consuming application must independently validate and sanitize all file paths supplied to Workbook.addImage() before invocation: resolve the input path with Node.js path.resolve(), confirm it falls within an explicitly allowed base directory using a startsWith() check, and reject any path containing traversal sequences. This workaround must be implemented at the application layer, introduces ongoing maintenance overhead, and is not a substitute for patching. Upgrading to 5.0.0 is the definitive remediation.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same weakness CWE-73 – External Control of File Name or Path
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today