Executive brief
Laravel Excel is a popular library that allows PHP applications to export data to spreadsheet files. A flaw in how it handles file paths allows an attacker who can control the export filename to overwrite any existing file on the server that the web process can write to—including critical PHP files. By crafting malicious cell data, an attacker could achieve remote code execution by overwriting a reachable PHP file.
Technical details
The vulnerability lies in `Maatwebsite\Excel\Files\Disk::copy()`, which uses `realpath()` to resolve the destination path. `realpath()` resolves against the current working directory (e.g., `public/`) rather than the configured disk root, and when the resolved path exists, the code opens it with `fopen($destination, 'rb+')` and writes directly to the filesystem, completely bypassing Flysystem's path confinement. This allows directory traversal (`../`) and absolute paths to escape the disk root. Additionally, the `rb+` mode does not truncate, leaving trailing bytes from previous file contents. An attacker must control the export path passed to `Excel::store()`, `$export->store()`, or `->storeExcel()`, and the target file must already exist. Because CSV and HTML exporters emit cell values verbatim, overwriting a PHP file reachable by the web server results in code execution. The vulnerability affects versions 3.1.8 through 3.1.69 and is patched in 3.1.70, which always routes exports through Flysystem.
Affected products
- Maatwebsite Laravel Excel >= 3.1.8, < 3.1.70
Timeline
- 2026-09-08: disclosed: GitHub Advisory published
- 2026-09-08: patched: Version 3.1.70 released with fix
- 2026-08-13: other: Advisory initially posted to repository
- 2026-09-01: other: NVD entry published for CVE-2026-84374