CVE-2026-78208
exceljs through 4.4.0 Path Traversal via Unvalidated addImage filename
- State
- Published
- Severity
- 8.7 High
- Published
- Aug 24, 2026
- Updated
- Aug 29, 2026
- Reserved
- Aug 24, 2026
Description
exceljs through 4.4.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-73 External Control of File Name or Path
Affected Products
| Product | Versions |
|---|---|
exceljsexceljs |
|
References
- https://github.com/exceljs/exceljsproduct
- GitHub Security Advisory (GHSA-m8mg-8574-gm3m)third-party-advisory
- https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/workbook.js#L142-L147technical-description
- https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xlsx.js#L421-L429technical-description
- VulnCheck Advisory: exceljs through 4.4.0 Path Traversal via Unvalidated addImage filenamethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.