Description

exceljs-hardened before 5.0.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-24T01:16:58.280Z",
  "pubdate": "2026-08-24T01:16:58.280Z",
  "executiveSummary": "An arbitrary file read vulnerability exists within the exceljs-hardened package prior to version 5.0.0. The flaw resides in the Workbook.addImage() function, which fails to adequately sanitize and validate user-supplied file paths.\nBy supplying maliciously crafted file paths to the vulnerable function, an authenticated or unauthenticated attacker capable of controlling image addition parameters can force the Node.js process to read arbitrary files from the underlying filesystem.\nThe retrieved file contents are subsequently embedded directly into the generated spreadsheet workbook. This exposes sensitive system files, configuration data, and internal source code accessible to the privileges of the executing Node.js runtime.\nThe risk implication is severe, as successful exploitation results in unauthorized data exposure and potential information disclosure of critical host assets. Remediation requires updating the affected library to version 5.0.0 or later where the path validation checks are properly implemented.",
  "technicalDetails": "The vulnerability stems from improper input validation within the Workbook.addImage() function provided by the exceljs-hardened library in versions prior to 5.0.0.\nThe root cause is the lack of strict path normalization and restriction checks on input parameters intended to reference local image resources. Specifically, the component fails to prevent directory traversal sequences such as relative path notation.\nThe vulnerable component is the Workbook.addImage() method in exceljs-hardened before version 5.0.0, executing within a Node.js process environment.\nAttackers exploit this flaw by passing arbitrary, absolute, or relative file paths (e.g., traversing upward via dot-dot-slash sequences) as arguments to the image addition routine.\nThe step-by-step attack flow proceeds as follows: First, the attacker identifies an application endpoint or interface that utilizes Workbook.addImage() and accepts user-controlled path input. Second, the attacker crafts an input payload containing a traversal sequence pointing to a sensitive target file readable by the Node.js process (such as /etc/passwd or application configuration files). Third, the application invokes Workbook.addImage() with the malicious path without enforcing boundary checks. Fourth, the Node.js runtime opens the targeted file based on the unsanitized path. Fifth, the library reads the file contents and embeds the resulting binary data directly into the output workbook structure. Finally, the generated workbook is returned or saved, granting the attacker unauthorized access to the contents of the target file.\nNo specific authentication or privilege requirements are inherently mandated by the vulnerability itself; exploitability depends entirely on how the application exposes the vulnerable function to external inputs. The network exposure is dictated by the architecture of the application leveraging the library.\nPost-exploitation impact is characterized by arbitrary file disclosure, potentially leaking environment variables, secrets, credentials, or proprietary source code accessible within the execution context of the Node.js process."
}