Executive brief
exceljs is a popular Node.js library used to read, write, and manipulate Excel spreadsheets. A path traversal vulnerability in the Workbook.addImage() function allows attackers to embed arbitrary files from the server into generated Excel workbooks, potentially exposing sensitive data such as configuration files, private keys, or other confidential information stored on the system.
Technical details
The Workbook.addImage() function in exceljs through version 4.4.0 fails to validate and sanitize file paths, allowing path traversal attacks. An attacker can supply crafted file paths (e.g., using ../ sequences) to read any file accessible to the Node.js process and embed it into the generated workbook. The attack requires the attacker to control input passed to the addImage() function, typically through an untrusted data source or API endpoint. Successful exploitation allows arbitrary file disclosure without authentication, potentially exposing sensitive system or application data. Patch status depends on exceljs maintainer response; upgrading beyond 4.4.0 is recommended once available.
Affected products
- exceljs exceljs through 4.4.0
Timeline
- 2026-08-24: disclosed