CVE-2026-84374 SpartnerNL CVE debrief

Who should care

Developers and administrators of Laravel applications using the Laravel Excel package, especially those who allow user input to control export paths, should assess their exposure and take steps to mitigate the vulnerability.

Why it matters

CVE-2026-84374 is a high-severity vulnerability in Laravel Excel that allows an attacker to overwrite arbitrary files on the system, potentially leading to remote code execution. Developers and administrators of Laravel applications using the Laravel Excel package should assess their exposure and take steps to mitigate the vulnerability.

• Potential for remote code execution if an executable PHP file is overwritten
• Arbitrary file overwrite capabilities for an attacker
• Increased risk of system compromise

Technical summary

The vulnerability exists in the Maatwebsite/Excel/Files/Disk.php file, where the realpath() function is used to resolve the export path against the process working directory instead of the configured filesystem disk. This allows an attacker to overwrite arbitrary files on the system, potentially leading to remote code execution. The issue arises from versions 3.1.8 through 3.1.69 and is fixed in version 3.1.70. Developers should assess their exposure, especially if user input controls export paths, and take steps to mitigate the vulnerability. Upgrading to version 3.1.70 or later is recommended. The vulnerability can be exploited by manipulating the export path, allowing an attacker to overwrite existing files, including executable PHP files, which can lead to remote code execution. The rb+ behavior in Disk::copy() creates a non-truncating overwrite and trailing bytes when the new export is shorter. To prevent such attacks, validating user input and implementing additional security measures are crucial. Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite/Excel/Files/Disk::copy() method resolves the caller-controlled $destination supplied through Excel::store(), $export->store(), or storeExcel() against the process working directory with realpath() instead of the configured filesystem disk. If the path names an existing writable file, Disk::copy() opens it with fopen() in rb+ mode and uses stream_copy_to_stream(), bypassing Flysystem path confinement and allowing an attacker whose application input controls the export path to overwrite arbitrary existing files with export content. The rb+ behavior creates a non-truncating overwrite and trailing bytes when the new export is shorter, and overwriting an executable PHP file can lead to remote code execution. This issue is fixed in version 3.1.70. The vulnerability allows an attacker to overwrite arbitrary files on the system, potentially leading to remote code execution if an executable PHP file is overwritten. The vulnerability exists in versions 3.1.8 through 3.1.69 and is fixed in version 3.1.70. Developers and administrators of

Defensive priority

High

Recommended defensive actions

• Upgrade to version 3.1.70 or later
• Review and validate user input for export paths
• Implement additional security measures to prevent file overwrites
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by the insecure use of the realpath() function in the Maatwebsite/Excel/Files/Disk.php file, which allows an attacker to resolve the export path against the process working directory instead of the configured filesystem disk. This can be exploited by an attacker to overwrite arbitrary files on the system, potentially leading to remote code execution.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.