Description

Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\Excel\Files\Disk::copy() method resolves the caller-controlled $destination supplied through Excel::store(), $export->store(), or storeExcel() against the process working directory with realpath() instead of the configured filesystem disk. If the path names an existing writable file, Disk::copy() opens it with fopen() in rb+ mode and uses stream_copy_to_stream(), bypassing Flysystem path confinement and allowing an attacker whose application input controls the export path to overwrite arbitrary existing files with export content. The rb+ behavior creates a non-truncating overwrite and trailing bytes when the new export is shorter, and overwriting an executable PHP file can lead to remote code execution. This issue is fixed in version 3.1.70.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-01T22:17:19.293Z",
  "pubdate": "2026-09-01T22:17:19.293Z",
  "executiveSummary": "The Laravel Excel package (versions 3.1.8 through 3.1.69) is susceptible to an arbitrary file overwrite vulnerability due to insecure path resolution within the file system abstraction layer. This flaw allows an attacker capable of controlling the destination path in export functions (e.g., Excel::store(), $export->store(), or storeExcel()) to bypass Flysystem directory confinement.\nBy manipulating the destination path, an attacker can target arbitrary files on the server's filesystem. When the targeted file exists, the application opens it in 'rb+' mode and performs a non-truncating write operation using stream_copy_to_stream(). This behavior enables the injection of arbitrary content into sensitive files, including executable PHP scripts, leading to potential Remote Code Execution (RCE).\nThe vulnerability represents a critical risk to the integrity and security of the host application, as it allows for unauthorized modification of system files or application code. The flaw resides in the Maatwebsite\\Excel\\Files\\Disk::copy() method, which incorrectly uses realpath() to resolve file paths against the process working directory rather than the intended storage disk. Successful exploitation requires the attacker to have control over the export file path input.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the Maatwebsite\\Excel\\Files\\Disk::copy() method within the Laravel Excel package. When an export operation is initiated via methods such as Excel::store(), the package attempts to determine the destination path of the generated Excel file. Instead of relying on the configured Flysystem disk abstraction layer to securely resolve and constrain the destination path to the designated storage directory, the Disk::copy() method incorrectly utilizes realpath() against the current process working directory.\nThis improper path resolution permits path traversal and absolute path injection. If an attacker provides a path that resolves to an existing file outside of the intended storage directory, the application fails to restrict access. Upon resolving the path, the Disk::copy() function invokes fopen() with the 'rb+' (read/write binary) mode. This specific mode does not truncate the existing file upon opening.\nThe exploitation flow proceeds as follows: First, the attacker identifies an entry point where the application accepts a user-controlled string as a destination path for an Excel export. Second, the attacker supplies an absolute path or a path traversal sequence targeting a sensitive file, such as a PHP configuration file, a script, or an application source file. Third, the application's Disk::copy() method resolves this path and opens the target file. Fourth, the application streams the export content into the target file. Because the 'rb+' mode is used, the content is injected starting at the beginning of the file; if the export content is shorter than the original file, the remaining original bytes persist, which may result in a malformed but potentially executable file.\nThe impact of this vulnerability is severe. By overwriting an executable PHP file with carefully crafted export content containing PHP code, an attacker can achieve Remote Code Execution. The vulnerability affects Laravel Excel versions 3.1.8 through 3.1.69. It does not require specific authentication beyond the attacker's ability to trigger the export function, and it is independent of network configuration provided the attacker has an authenticated context to request the export."
}