File Overwrite Vulnerability in Laravel Excel by Maatwebsite

CVE-2026-84374

What is CVE-2026-84374?

The Laravel Excel library versions 3.1.8 through 3.1.70 can potentially allow an attacker to overwrite arbitrary files through manipulated export paths. This occurs as the Disk::copy() method uses the caller-controlled $destination from various Excel storing functions to write files in an unintended manner. If the specified destination points to an existing writable file, the function opens it in a non-truncating mode, thereby risking the integrity of the existing file's contents. This could lead to critical consequences, including the possibility of remote code execution if the exported content includes malicious PHP code. The vulnerability has been addressed in version 3.1.70.

References