Vulnerability Description
exceljs through 4.4.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/exceljs/exceljs
- https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/workbook.js#L142-L147
- https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xlsx.js#L421-L429
- https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-m8mg-85
- https://www.vulncheck.com/advisories/exceljs-through-path-traversal-via-unvalida
FAQ
What is CVE-2026-78208?
CVE-2026-78208 is a vulnerability with a CVSS score of 7.5 (HIGH). exceljs through 4.4.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessib...
How severe is CVE-2026-78208?
CVE-2026-78208 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-78208?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.