Laravel Excel
Monthly
Path traversal in Laravel Excel (versions 3.1.8-3.1.69) allows authenticated low-privilege users to overwrite arbitrary existing files on the server by supplying a crafted destination path to `Excel::store()`, `$export->store()`, or `storeExcel()`. The vulnerable `Disk::copy()` method resolves caller-controlled paths via `realpath()` against the process working directory, then opens matched files directly with `fopen(rb+)` and `stream_copy_to_stream()`, bypassing Flysystem's path confinement entirely. When the overwritten target is a web-accessible PHP file, this escalates to remote code execution; no public exploit is identified at time of analysis.
Path traversal in Laravel Excel (versions 3.1.8-3.1.69) allows authenticated low-privilege users to overwrite arbitrary existing files on the server by supplying a crafted destination path to `Excel::store()`, `$export->store()`, or `storeExcel()`. The vulnerable `Disk::copy()` method resolves caller-controlled paths via `realpath()` against the process working directory, then opens matched files directly with `fopen(rb+)` and `stream_copy_to_stream()`, bypassing Flysystem's path confinement entirely. When the overwritten target is a web-accessible PHP file, this escalates to remote code execution; no public exploit is identified at time of analysis.