CyberRota Analysis
AI-GeneratedLaravel Excel versions 3.1.8 to 3.1.70 are vulnerable due to improper handling of user-controlled file paths in the Disk::copy() method, allowing attackers to overwrite arbitrary files, including executable PHP files, potentially leading to remote code execution. Organizations using affected versions should prioritize patching to version 3.1.70 or later to mitigate this high-severity risk. This vulnerability is particularly critical for applications that rely on user input for file exports, as it directly impacts the integrity and security of the filesystem.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\Excel\Files\Disk::copy() method resolves the caller-controlled $destination supplied through Excel::store(), $export->store(), or storeExcel() against the process working directory with realpath() instead of the configured filesystem disk. If the path names an existing writable file, Disk::copy() opens it with fopen() in rb+ mode and uses stream_copy_to_stream(), bypassing Flysystem path confinement and allowing an attacker whose application input controls the export path to overwrite arbitrary existing files with export content. The rb+ behavior creates a non-truncating overwrite and trailing bytes when the new export is shorter, and overwriting an executable PHP file can lead to remote code execution. This issue is fixed in version 3.1.70.