THREATOPS
THREAT OPS › Threat News › [GHSA] GHSA-c7r6-vx3h-w5g2 (high) — Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path

[GHSA] GHSA-c7r6-vx3h-w5g2 (high) — Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path

medgithub_advisoriesPublished 2026-09-08

GHSA-c7r6-vx3h-w5g2 Severity: high CVE: CVE-2026-84374

Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path

### Summary

`Excel::store()` resolved the destination path against the process working directory rather than the configured filesystem disk. When that path resolved to an existing file, the export was written straight to it with `fopen()`

Indicators of compromise

Original source: https://github.com/advisories/GHSA-c7r6-vx3h-w5g2