CVE-2026-84374
1 advisory.
Packagist/maatwebsite/excel CVE-2026-84374: high 7.5
Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path
Action: Upgrade maatwebsite/excel to 3.1.70 or later.
composer require maatwebsite/excel:3.1.70Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.1.8 | 3.1.70 | - |
Fixed versions
| 3.1.70 |
Sources
- osv: GHSA-c7r6-vx3h-w5g2
- https://github.com/SpartnerNL/Laravel-Excel/security/advisories/GHSA-c7r6-vx3h-w5g2
- https://nvd.nist.gov/vuln/detail/CVE-2026-84374
- https://github.com/SpartnerNL/Laravel-Excel/commit/b5cafdfcf7ec63924e83303763be8fcae340f70b
- https://github.com/SpartnerNL/Laravel-Excel
- https://github.com/SpartnerNL/Laravel-Excel/releases/tag/3.1.70
CVE-2026-84374 · published · modified · JSON