CVE-2026-84374

Executive Summary

CVE-2026-84374 is a path traversal and arbitrary file overwrite vulnerability affecting the Laravel Excel package (Maatwebsite\Excel) in versions 3.1.8 through 3.1.69 (fixed in 3.1.70). The flaw resides in the Disk::copy() method within src/Files/Disk.php, where caller-controlled destination paths supplied via export methods (Excel::store(), $export->store(), or storeExcel()) are resolved against the process working directory using realpath() rather than the configured filesystem disk. This bypasses Flysystem path confinement, allowing an authenticated attacker who controls the export destination to overwrite arbitrary existing files on the server, potentially including executable PHP files for remote code execution. The vulnerability carries a CVSS score of 7.5 (High) with a vector of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Patch confidence is 0/4, though the vendor has confirmed a fix in version 3.1.70.

Technical Analysis

The vulnerability exists in the Laravel Excel package, a widely used library for exporting and importing Excel files within the Laravel PHP framework. The affected component is the Maatwebsite\Excel\Files\Disk::copy() method located in src/Files/Disk.php.

Root Cause Mechanism:

The Disk::copy() method accepts a caller-controlled $destination parameter. This parameter can be influenced by application input through public-facing export methods: Excel::store(), $export->store(), or storeExcel(). The critical flaw is that the method resolves the destination path using PHP's realpath() function against the process working directory rather than resolving it against the configured filesystem disk (e.g., S3 bucket, local disk, etc.).

In Laravel's filesystem architecture, the Flysystem abstraction layer provides path confinement — paths are intended to be resolved relative to the mounted disk root. By circumventing this confinement with realpath(), the method resolves paths relative to the server's working directory (typically the Laravel application root), allowing traversal outside the intended disk boundary.

File Handling Behavior:

When the resolved path names an existing writable file, Disk::copy() opens it using fopen() in rb+ mode — read/binary with write access, positioned at the start of the file. It then copies export content to this handle using stream_copy_to_stream(). The rb+ mode has two significant security implications:

1. Non-truncating overwrite: Unlike wb mode, rb+ does not truncate the file to zero length before writing. This means if the new export content is shorter than the existing file, residual trailing bytes remain at the end of the file. An attacker overwriting a file with content longer than the target will truncate at the written length, but shorter content leaves orphaned data, potentially corrupting the target file's integrity.

2. Arbitrary file overwrite: Because the path resolution bypasses disk confinement, an attacker can target any file the web server process has write permission to — including configuration files, uploaded assets, cache files, or PHP source files.

RCE Potential:

The most critical exploitation vector is overwriting an executable PHP file. Since the overwritten content is the Excel export data (which may include attacker-controlled cell content), an attacker could craft an Excel file containing PHP code in cells, then direct the export operation to overwrite a writable PHP file (e.g., a cached template, a public-facing script, or an auto-loaded class). When subsequently requested, the PHP interpreter would execute the injected code, resulting in remote code execution.

Attack Surface:

The attack surface includes any Laravel application using Laravel Excel where the export destination filename or path is derived from user-supplied input. Common scenarios include:

• Export routes where the filename includes a user-supplied parameter (e.g., ?filename=report_2024.xlsx)
• Multi-tenant applications where the export path incorporates tenant identifiers
• Applications allowing users to specify export format or directory names

CWE Classification: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). The core issue is path normalization occurring against the wrong base directory.

Exploitation Scenarios

Note: No public PoC or exploit code is available as of this report; the attack chain is inferred from the vulnerability class and the NVD description.

Step 1 — Reconnaissance/Target Identification: An attacker would first identify Laravel applications running the affected Laravel Excel version (3.1.8–3.1.69). Fingerprinting techniques include: examining composer.lock exposure, identifying Laravel-specific HTTP response headers (X-Powered-By: PHP), recognizing export endpoints (routes ending in .xlsx, .csv, or parameter names like export), and leveraging application behavior — triggering exports and observing response patterns. Version confirmation may be achieved through error messages, changelog disclosures, or dependency exposure.

Step 2 — Triggering the Flaw: The attacker needs to control the export destination path. For example, if an application endpoint accepts a filename or path parameter for export storage (e.g., POST /exports?path=exports/report.xlsx), the attacker would supply a path containing directory traversal sequences or absolute paths — for instance, ../../../public/cache/template.php or ../../config/app.php. The realpath() resolution in Disk::copy() resolves this against the process working directory, producing a server-absolute path, bypassing the intended Flysystem disk root confinement.

Step 3 — Payload Construction and Execution: Because the overwritten content is the exported Excel data, the attacker crafts an Excel file where cell values contain PHP code (e.g., <?php system($_GET['cmd']); ?>). The export operation writes this content to the targeted file. If the target is a PHP file reachable via web request, subsequent HTTP access to that file triggers PHP evaluation, resulting in remote code execution. The rb+ non-truncating write behavior is relevant here: if the attacker's payload is shorter than the existing target file, trailing bytes remain — however, for PHP files, the injected code at the start executes before any trailing garbage causes a parse error (depending on the exact byte offsets).

Step 4 — Post-Exploitation Impact: Successful exploitation yields:

• Remote Code Execution (if a valid PHP target is overwritten): full server compromise, enabling lateral movement, data exfiltration, ransomware deployment, or persistence.
• Integrity compromise (if non-PHP files overwritten): corruption of application configuration, defacement of static assets, or DoS via critical file destruction.
• Confidentiality impact via the High CVSS scores: if the attacker can overwrite files such as .env or configuration files containing credentials, subsequent requests to those files may expose sensitive data.

Caveat: The attack requires an authenticated user (PR:L — Low privileges) and is constrained by the High complexity (AC:H) of path resolution dynamics and file write permissions. However, low-privileged application users commonly have export access.

Impact Assessment

CVSS Analysis: The vulnerability scores 7.5 (High) under CVSS v3.1 with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H:

• Attack Vector: Network — exploitable remotely via HTTP requests
• Attack Complexity: High — requires precise path manipulation knowledge and target file write permissions
• Privileges Required: Low — any authenticated user with export capability
• User Interaction: None — no victim action needed
• Scope: Unchanged — impact confined to the vulnerable system
• Confidentiality/Integrity/Availability: High — potential for full server compromise

Business Impact:

• Application Compromise: RCE allows full takeover of the application and underlying server.
• Data Breach: Overwritten configuration files may expose credentials, API keys, or customer PII.
• Service Disruption: Critical file corruption can cause cascading application failures.
• Supply Chain Risk: Laravel Excel is widely adopted in enterprise Laravel ecosystems; supply chain compromise of the package could affect thousands of applications.

Affected Systems: All Laravel applications using Maatwebsite/Laravel-Excel v3.1.8 through v3.1.69 where export destination paths are influenced by user input. The attack is limited to environments where the web server process has write access to the targeted files — which is common on shared hosts or misconfigured production environments.

Detection Guidance

Sigma Rule

title: Laravel Excel Disk::copy() Path Traversal Attempt
id: 2f7f3c8a-7e51-4a6b-8f2d-9a1d3f5e6a7b
status: experimental
description: Detects path traversal sequences in export path parameters targeting Laravel Excel Disk::copy() vulnerability CVE-2026-84374
author: Valtersit Threat Intelligence
date: 2026/04/01
logsource:
    category: webserver
    product: generic
detection:
    selection:
        http.url|contains:
            - 'path='
            - 'filename='
            - 'destination='
            - 'dir='
            - 'export_path='
        http.url|contains|all:
            - '..%2f'
            - '..%5c'
        http.url|contains|any:
            - '\.php'
            - '\.env'
            - '\.conf'
            - '\.ini'
            - '\.yml'
            - '\.yaml'
            - '\.xml'
    filter_known_good:
        http.url|contains:
            - '/public/'
            - '/storage/'
    condition: selection and not filter_known_good
level: high
falsepositives:
    - Legitimate file management features allowing path specification
    - Pentesting or internal QA activity
tags:
    - attack.t1190
    - cve.2026.84374
    - cwe.22

YARA Rule

rule CVE_2026_84374_Laravel_Excel_Path_Traversal
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects malicious path traversal patterns targeting Laravel Excel Disk::copy vulnerability"
        date = "2026-04-01"
        cve = "CVE-2026-84374"
        reference = "Laravel-Excel src/Files/Disk.php"
        severity = "high"
    
    strings:
        $traversal_unix = /\.\.\/{2,}[a-zA-Z0-9_\-\/]*\.(php|env|conf|ini|yml|yaml|xml)/
        $traversal_windows = /\.\.\\{1,}[a-zA-Z0-9_\-\/]*\.(php|env|conf|ini|yml|yaml|xml)/
        $traversal_encoded = /%2e%2e%2[fF]%2e%2e%2[fF]/
        $fopen_rb = "fopen"
        $stream_copy = "stream_copy_to_stream"
        $realpath = "realpath"
        $excel_store = /Excel::(store|export)/
        $method_copy = "Disk::copy"
        $rb_mode = "\"rb+\""
    
    condition:
        (
            uint16(0) == 0x5A4D or          // PE file (Windows)
            filesize < 10MB
        ) and
        (
            $traversal_unix or
            $traversal_windows or
            $traversal_encoded
        ) and
        (
            $fopen_rb and
            $stream_copy and
            ($realpath and ($excel_store or $method_copy) and $rb_mode)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-84374 - Laravel Excel Path Traversal Attempt"; flow:established,to_server; content:"..%2f"; nocase; content:"..%5c"; nocase; pcre:"/(\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e%5c)/i"; pcre:"/\.(php|env|conf|ini|yml|yaml|xml)[\s\?&]?/i"; classtype:attempted-admin; reference:cve,2026-84374; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-84374; sid:2026040101; rev:1;)

Elastic Detection

// EQL query for detecting path traversal attempts targeting export endpoints
sequence by source.ip
  [network where event.category == "web" and 
   url.query contains "path=" or url.query contains "filename=" or
   url.query contains "destination=" or url.query contains "dir="]
  [file where event.category == "file" and 
   process.name contains "php" and
   file.path contains ".." and
   (file.extension in ("php", "env", "conf", "ini", "yml", "yaml", "xml") or
    file.name in (".env", "config.php"))]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=iis
| where searchmatch("path=") OR searchmatch("filename=") OR searchmatch("destination=")
| regex _raw="(\\.\\./|%2e%2e%2f|\\.\\.\\\\|%2e%2e%5c)"
| regex _raw="\\.(php|env|conf|ini|yml|yaml|xml)"
| eval threat_score = case(
        match(_raw, "(\.\./|%2e%2e%2f)") AND match(_raw, "\.php"), "CRITICAL",
        match(_raw, "\.env"), "HIGH",
        match(_raw, "(\.\./|%2e%2e%2f)"), "MEDIUM",
        true(), "LOW"
    )
| stats count by src_ip, uri, threat_score, _time
| where count > 1
| sort - _time
| table _time, src_ip, uri, threat_score, count

Wazuh OSSEC Rule

<group name="laravel-excel,cve-2026-84374,">
  <rule id="100401" level="12">
    <if_sid>31100</if_sid>
    <match>\.\.%2f|\.\.%5c|\.\./|\.\.\\</match>
    <regex>\.(php|env|conf|ini|yml|yaml|xml)</regex>
    <description>CVE-2026-84374 - Laravel Excel path traversal attempt detected targeting sensitive file extension</description>
    <group>attack.t1190,cwe.22,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="100402" level="15">
    <if_sid>100401</if_sid>
    <match>\.php</match>
    <description>CVE-2026-84374 - Critical: Path traversal targeting PHP file - possible RCE attempt</description>
    <group>attack.t1190,cwe.22,</group>
  </rule>

  <rule id="100403" level="14">
    <if_sid>100401</if_sid>
    <match>\.env</match>
    <description>CVE-2026-84374 - Path traversal targeting .env file - credential exposure attempt</description>
    <group>attack.t1190,cwe.22,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: Patch confidence is 0/4 — no patch evidence from any tracked source. However, the NVD description explicitly states "This issue is fixed in version 3.1.70."

Immediate Mitigations (before patching):

1. Validate and whitelist export paths: Implement application-level validation of all destination paths passed to Excel::store(), $export->store(), or storeExcel(). Reject any path containing .., absolute paths, or paths escaping a predefined allowed directory.
2. Restrict web server file write permissions: Ensure the PHP process runs under a least-privilege account with write access only to the designated storage directories (storage/, public/uploads/). Deny write access to sensitive directories (config/, bootstrap/, application root).
3. Disable PHP execution in writable directories: Configure the web server to disable PHP execution in directories where the application writes files (e.g., .htaccess with php_flag engine off or Nginx location blocks).
4. Input sanitization middleware: Add a global middleware to sanitize the path, filename, and destination input parameters to strip traversal sequences.
5. Upgrade immediately: Update to version 3.1.70 or later, which contains the official fix. Verify composer.json and run composer update maatwebsite/excel.

Patch/Upgrade Steps:

1. composer require maatwebsite/excel:^3.1.70 (or update the existing constraint)
2. Set "maatwebsite/excel": "^3.1.70" in composer.json
3. Run composer update maatwebsite/excel
4. Run your test suite to verify export functionality still works
5. Review and retest all export endpoints

Long-Term Hardening:

• Least privilege filesystem: Run PHP-FPM under a dedicated user with write access limited strictly to storage/ and public/ subdirectories.
• WAF rules: Deploy Web Application Firewall rules blocking path traversal patterns (..%2f, ..%5c, ..\/) and requests targeting sensitive files (.env, *.php) via export parameters.
• Security dependency scanning: Integrate composer audit or SCA tools into CI/CD pipeline to catch vulnerable package versions proactively.
• Filesystem extension validation: Enforce file extension whitelist for all export outputs server-side.
• Runtime file monitoring: Implement file integrity monitoring (FIM) on critical directories (app/, config/, public/) to detect unauthorized modifications.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-84374
2. Vendor Advisory (GitHub): Maatwebsite/Laravel-Excel — Release notes for version 3.1.70 fix: https://github.com/SpartnerNL/Laravel-Excel/releases/tag/3.1.70
3. CWE-22 Reference: https://cwe.mitre.org/data/definitions/22.html — Improper Limitation of a Pathname to a Restricted Directory
4. Flysystem Documentation (path confinement context): https://flysystem.thephpleague.com/docs/
5. CISA Known Exploited Vulnerabilities Catalog: CVE-2026-84374 is NOT listed in CISA KEV catalog as of this report date.

Threat Actor Activity: As of this report, there is no evidence of exploitation in the wild, no published PoC, no Nuclei template, and no exploit code associated with CVE-2026-84374. The EPSS score has not been assigned by FIRST.org. However, given the High CVSS score and the prevalence of Laravel applications in enterprise environments, active exploitation attempts are anticipated within 30–90 days of the public disclosure. Monitor outbound HTTP logs for path traversal signatures and review export-related endpoint logs for anomalous destination parameters.