CVE-2026-78208: exceljs through 4.4.0 Path Traversal via Unvalidated addImage filename
exceljs-hardened before 5.0.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
exceljsto a version that resolves this vulnerability.Fixed in 4.4.0 - Upgrade
Upgrade
exceljs-hardenedto a version that resolves this vulnerability.Fixed in 5.0.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications using exceljs-hardened versions before 5.0.0 are affected. The issue applies where untrusted input can influence the filename passed to Workbook.addImage().
What does an attacker need to exploit this?
An attacker needs a way to supply an arbitrary file path to Workbook.addImage() through the application. No authentication or user interaction is required according to the provided severity vector.
What is the impact of successful exploitation?
The attacker can cause the Node.js process to read files accessible to its operating-system account and embed their contents in a generated workbook. Integrity and availability impact are not indicated.
What can be done before upgrading?
Do not pass untrusted filenames directly to Workbook.addImage(). Restrict image inputs to approved files or paths and validate that resolved paths remain within an intended directory.