Quick answers
- Is CVE-2026-78208 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-78208 being exploited in the wild.
- How severe is CVE-2026-78208?
- High severity, with a CVSS score of 7.5, published 24 August 2026.
- Which products and versions are affected?
- exceljs exceljs through 4.4.0.
- Is there a fix for CVE-2026-78208?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-78208 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-78208?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The Workbook.addImage() function in exceljs through version 4.4.0 fails to validate and sanitize file paths, allowing path traversal attacks. An attacker can supply crafted file paths (e.g., using ../ sequences) to read any file accessible to the Node.js process and embed it into the generated workbook. The attack requires the attacker to control input passed to the addImage() function, typically through an untrusted data source or API endpoint. Successful exploitation allows arbitrary file disclosure without authentication, potentially exposing sensitive system or application data. Patch status depends on exceljs maintainer response; upgrading beyond 4.4.0 is recommended once available.
Affected products
- exceljs exceljs through 4.4.0
Timeline
- 2026-08-24: disclosed