CVE-2026-84374

Name of the Vulnerable Software and Affected Versions Laravel Excel versions 3.1.8 through 3.1.69

Description The MaatwebsiteExcelFilesDisk::copy() function in src/Files/Disk.php resolves the $destination variable, provided via Excel::store(), $export->store(), or storeExcel(), against the process working directory using realpath() instead of the configured filesystem disk. This allows an attacker who controls the export path to bypass Flysystem path confinement and overwrite arbitrary writable files with export content. Because the file is opened in rb+ mode, the overwrite is non-truncating, which may leave trailing bytes if the new content is shorter. Overwriting an executable PHP file can lead to remote code execution.

Recommendations Update to version 3.1.70.