Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| maatwebsite/excel | composer | >= 3.1.8, < 3.1.70 | 3.1.70 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-84374, in Laravel Excel (maatwebsite/excel) allowed for arbitrary file overwrites due to improper path resolution within the Disk::copy method. The core issue stemmed from the use of realpath($destination) which resolved the provided $destination path against the process's current working directory, rather than the configured filesystem disk's root. If realpath($destination) returned a valid, existing file path, the method would then directly write to this file using fopen($destination, 'rb+'), completely bypassing the Flysystem disk driver. This meant that any path validation or confinement mechanisms provided by Flysystem were circumvented. An attacker could supply a user-controlled path that pointed to an existing file outside the intended disk root, leading to an overwrite. The patch explicitly removes this if (realpath($destination)) block, ensuring that all file write operations are routed through $this->put($destination, $readStream), which correctly utilizes the configured Flysystem disk and its inherent path validation and security controls. The Excel::store() method calls this vulnerable Disk::copy() method, making it the entry point for exploitation when user-controlled input is passed as the file path.
Maatwebsite\Excel\Files\Disk::copysrc/Files/Disk.php