CVE-2026-84374

Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\Excel\Files\Disk::copy() method resolves the caller-controlled $destination supplied through Excel::store(), $export->store(), or storeExcel() against the process working directory with realpath() instead of the configured filesystem disk. If the path names an existing writable file, Disk::copy() opens it with fopen() in rb+ mode and uses stream_copy_to_stream(), bypassing Flysystem path confinement and allowing an attacker whose application input controls the export path to overwrite arbitrary existing files with export content. The rb+ behavior creates a non-truncating overwrite and trailing bytes when the new export is shorter, and overwriting an executable PHP file can lead to remote code execution. This issue is fixed in version 3.1.70.

• CWE-22
• CWE-73

• https://github.com/SpartnerNL/Laravel-Excel/commit/b5cafdfcf7ec63924e83303763be8fcae340f70b
• https://github.com/SpartnerNL/Laravel-Excel/releases/tag/3.1.70
• https://github.com/SpartnerNL/Laravel-Excel/security/advisories/GHSA-c7r6-vx3h-w5g2

Published

Sep 1, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-84368joi is a schema description language and data validator for …3.7
• CVE-2026-84369SVGO, short for SVG Optimizer, is a Node.js library and comm…6.1
• CVE-2026-84370SVGO, short for SVG Optimizer, is a Node.js library and comm…8.2
• CVE-2026-84371ApostropheCMS is an open-source Node.js content management s…5.4
• CVE-2026-84372Predis is a flexible and feature-complete Redis and Valkey c…9.8
• CVE-2026-84373Vitest is a testing framework powered by Vite. From 2.1.0 un…5.9
• CVE-2026-84375js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 u…7.5
• CVE-2026-84376Astro is a web framework for content-driven websites. Prior …6.3
• CVE-2026-84377LiteLLM is a proxy server (AI Gateway) to call LLM APIs in O…6.5
• CVE-2026-84378HTTPX2 is a next generation HTTP client for Python. From 2.5…5.9
• CVE-2026-84379HTTPX2 is a next generation HTTP client for Python. Prior to…5.3
• CVE-2026-8438The All-In-One Security (AIOS) – Security and Firewall plugi…7.2