Summary
Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path
Excel::store() resolved the destination path against the process working
directory rather than the configured filesystem disk. When that path resolved to
an existing file, the export was written straight to it with fopen(),
bypassing the disk entirely. An application that passes a user-controlled value
as the export path could therefore be made to overwrite an arbitrary existing
file that the PHP process can write to, with content the user controls.
Details
Maatwebsite\Excel\Files\Disk::copy() contained two paths:
if (realpath($destination)) {
$tempStream = fopen($destination, 'rb+');
$success = stream_copy_to_stream($readStream, $tempStream) !== false;
} else {
$success = $this->put($destination, $readStream);
}
$destination is the $filePath argument given to Excel::store(),$export->store() or ->storeExcel(). realpath() resolves it against the
current working directory, public/ for a typical web request, not
against the disk root. On a hit, the write went directly to the filesystem and
never reached Flysystem, which would otherwise have rejected ../ traversal and
confined absolute paths to the disk root. The disk argument was effectively
ignored for those paths, including for remote disks such as S3.
Two consequences follow:
- the destination could be any existing file the PHP process can write, in or
out of the disk root; - the stream was opened
'rb+', which does not truncate, so a shorter export
left trailing bytes of the previous file behind.
Because the file must already exist, the primitive is an overwrite rather
than an arbitrary file creation. Overwriting a PHP file that is reachable by the
web server (for example a front controller or a cached view) turns
attacker-controlled row content into code execution, since CSV and HTML writers
emit cell values verbatim. Passing an explicit writer type to store() bypasses
the extension-based type detection that would otherwise reject a .php target.
Exploitation requires the application to pass an unsanitized, user-controlled
value as the export path. Applications that pass a fixed or server-derived path
are not affected.
Workarounds
For anyone unable to upgrade, validate the path before passing it to store() ,
reject absolute paths and any .. segment, or derive the filename server-side
and never build it from request input:
$name = basename($request->input('filename')); // strips any directory part
Excel::store($export, 'exports/' . $name, 'local');
Credit
Reported responsibly by @seck19 via the contact address in SECURITY.md.
Impact
Arbitrary overwrite of existing files writable by the PHP process, with
partially attacker-controlled content, leading to remote code execution where
the overwritten file is executed by the web server.
Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.
CVE-2026-84374 has a CVSS score of 7.5 (High). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (3.1.70); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Fixed in 3.1.70. Disk::copy() now always writes through the configured
filesystem disk, so Flysystem enforces the disk root for every export.
Note the behaviour change: passing an absolute path to store() previously
wrote to that path once the file existed. Paths now always resolve relative to
the disk root. Applications that relied on that should configure a disk rooted
at the target location.
Frequently Asked Questions
- What is CVE-2026-84374? CVE-2026-84374 is a high-severity path traversal vulnerability in maatwebsite/excel (composer), affecting versions >= 3.1.8, < 3.1.70. It is fixed in 3.1.70. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
- How severe is CVE-2026-84374? CVE-2026-84374 has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of maatwebsite/excel are affected by CVE-2026-84374? maatwebsite/excel (composer) versions >= 3.1.8, < 3.1.70 is affected.
- Is there a fix for CVE-2026-84374? Yes. CVE-2026-84374 is fixed in 3.1.70. Upgrade to this version or later.
- Is CVE-2026-84374 exploitable, and should I be worried? Whether CVE-2026-84374 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-84374 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-84374? Upgrade
maatwebsite/excelto 3.1.70 or later.