CVE-2026-128347: ExcelJS through 4.4.0 Arbitrary File Read via WorkbookWriter addImage Filename
ExcelJS through 4.4.0 contains an arbitrary file read vulnerability in the streaming WorkbookWriter that allows attackers to read local files by supplying crafted image filenames to addImage. Attackers can inject ../ path segments into user-controlled image paths, causing addMedia to embed any file readable by the Node.js process under xl/media in the generated workbook.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using ExcelJS streaming WorkbookWriter are exposed if they pass attacker-controlled image filenames to addImage. The affected behavior can read files that are accessible to the Node.js process.
What does an attacker need to exploit it?
An attacker needs control over an image filename supplied to addImage. Crafted filenames containing ../ path segments can cause the workbook generation process to include local files in xl/media within the generated workbook.
What is the impact of a successful exploit?
The attacker can obtain the contents of arbitrary local files readable by the Node.js process, because those files are embedded in the generated workbook. The provided information describes confidentiality impact only; it does not indicate integrity or availability impact.
What can be done if upgrading is not immediately possible?
Do not allow untrusted input to determine image filenames passed to WorkbookWriter addImage. Restrict image paths to validated, expected files and reject path traversal sequences such as ../.