CVE-2026-78208

Publié : 24 août 2026

Modifié : 24 août 2026

Score CVSS

7.5

HIGH

Description détaillée

exceljs-hardened before 5.0.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Références et Patchs

https://github.com/exceljs/exceljs https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/workbook.js#L142-L147 https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xlsx.js#L421-L429 https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-m8mg-8574-gm3m https://www.vulncheck.com/advisories/exceljs-through-path-traversal-via-unvalidated-addimage-filename

Dernières Vulnérabilités

CVE-2026-78213

Heptabase developed by Hepta Platforms, Inc. has a Stored Cross-Site Scripting vulnerability. Authenticated remote attackers can inject persistent malicious content into specific pages, causing arbitrary JavaScript code to execute when other users click the crafted content.

VOIR DÉTAILS

CVE-2026-78212

4MOSAn developed by 4MOSAn Security Technology Co., Ltd. has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit a Relative Path Traversal flaw to download arbitrary system files.

VOIR DÉTAILS

CVE-2026-78211

4MOSAn GCB Doctor developed by 4MOSAn Security Technology has a OS Command Injection vulnerability. Unauthenticated remote attackers can inject malicious commands through an unremoved ADOdb test page parameter, thereby executing arbitrary system commands on the server.

VOIR DÉTAILS