{"id":"CVE-2026-84374","summary":"Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path","details":"Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\\Excel\\Files\\Disk::copy() method resolves the caller-controlled $destination supplied through Excel::store(), $export-\u003estore(), or storeExcel() against the process working directory with realpath() instead of the configured filesystem disk. If the path names an existing writable file, Disk::copy() opens it with fopen() in rb+ mode and uses stream_copy_to_stream(), bypassing Flysystem path confinement and allowing an attacker whose application input controls the export path to overwrite arbitrary existing files with export content. The rb+ behavior creates a non-truncating overwrite and trailing bytes when the new export is shorter, and overwriting an executable PHP file can lead to remote code execution. This issue is fixed in version 3.1.70.","aliases":["GHSA-c7r6-vx3h-w5g2"],"modified":"2026-09-03T03:48:19.805971271Z","published":"2026-09-01T21:28:30.355Z","database_specific":{"cwe_ids":["CWE-22","CWE-73"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84374.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/SpartnerNL/Laravel-Excel/releases/tag/3.1.70"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84374.json"},{"type":"ADVISORY","url":"https://github.com/SpartnerNL/Laravel-Excel/security/advisories/GHSA-c7r6-vx3h-w5g2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84374"},{"type":"FIX","url":"https://github.com/SpartnerNL/Laravel-Excel/commit/b5cafdfcf7ec63924e83303763be8fcae340f70b"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/spartnernl/laravel-excel","events":[{"introduced":"a0ff818c141c34c05a27578de8c00953efc2005e"},{"fixed":"b5cafdfcf7ec63924e83303763be8fcae340f70b"}],"database_specific":{"extracted_events":[{"introduced":"3.1.8"},{"fixed":"3.1.70"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["3.1.69","3.1.68","3.1.67","3.1.66","3.1.65","3.1.64","3.1.63","3.1.62","3.1.61","3.1.60","3.1.59","3.1.58","3.1.57","3.1.56","3.1.55","3.1.54","3.1.53","3.1.52","3.1.51","3.1.50","3.1.49","3.1.48","3.1.47","3.1.46","3.1.45","3.1.44","3.1.43","3.1.42","3.1.41","3.1.40","3.1.39","3.1.38","3.1.37","3.1.36","3.1.35","3.1.34","3.1.33","3.1.32","3.1.31","3.1.30","3.1.29","3.1.28","3.1.27","3.1.26","3.1.25","3.1.24","3.1.23","3.1.22","3.1.21","3.1.20","3.1.19","3.1.18","3.1.17","3.1.16","3.1.15","3.1.14","3.1.13","3.1.12","3.1.11","3.1.10","3.1.9","3.1.8"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84374.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}