{"action":"Upgrade maatwebsite/excel to 3.1.70 or later.","affected":[{"fixed":"3.1.70","introduced":"3.1.8"}],"component":"maatwebsite/excel","cve_ids":["CVE-2026-84374"],"ecosystem":"Packagist","epss":0.00842,"exploited":false,"fixed_versions":["3.1.70"],"ghsa_id":"GHSA-c7r6-vx3h-w5g2","id":"tcs_01M5KF0QD34GA02KGG5EFG33W6","modified_at":"2026-09-08T20:45:04.342404543Z","published_at":"2026-09-08T20:40:47Z","references":["https://osv.dev/vulnerability/GHSA-c7r6-vx3h-w5g2","https://github.com/SpartnerNL/Laravel-Excel/security/advisories/GHSA-c7r6-vx3h-w5g2","https://nvd.nist.gov/vuln/detail/CVE-2026-84374","https://github.com/SpartnerNL/Laravel-Excel/commit/b5cafdfcf7ec63924e83303763be8fcae340f70b","https://github.com/SpartnerNL/Laravel-Excel","https://github.com/SpartnerNL/Laravel-Excel/releases/tag/3.1.70"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-c7r6-vx3h-w5g2","url":"https://osv.dev/vulnerability/GHSA-c7r6-vx3h-w5g2"}],"summary":"Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path"}