CVE-2026-78208 in exceljs-hardened
Summary
by MITRE • 08/24/2026
exceljs-hardened before 5.0.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/24/2026
The exceljs-hardened library, prior to version 5.0.0, contains a critical path traversal vulnerability within its Workbook.addImage() function that allows attackers to perform unauthorized file system access through improper input validation. This security flaw stems from the application's failure to sanitize or validate user-supplied file paths before processing them for inclusion in Excel workbooks. When an attacker provides a maliciously crafted file path containing directory traversal sequences, such as dot-dot-slash combinations, the underlying Node.js runtime resolves these references against the server's local filesystem rather than restricting access to intended application directories. This lack of boundary enforcement enables the reading and embedding of arbitrary files into generated documents, effectively bypassing standard security controls designed to isolate application resources from sensitive system data.
From a technical perspective, this vulnerability represents a classic instance of insecure direct object reference combined with path traversal mechanics. The addImage() method is intended for inserting images located within specific, controlled directories associated with the workbook generation process. However, because the function does not normalize or restrict the input string to prevent upward directory navigation, it allows access to files outside the designated scope. This behavior aligns closely with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, where software fails to properly neutralize special elements that can cause paths to transition beyond restricted directories or files. The operational impact is severe, as Node.js processes often run with permissions sufficient to read configuration files, environment variables, source code, and other sensitive data stored on the host system. An attacker could exploit this flaw to exfiltrate credentials, proprietary algorithms, or internal network topology information by embedding these contents into a downloadable Excel file that can be easily retrieved via standard HTTP requests.
The exploitation of this vulnerability maps directly to several entries in the MITRE ATT&CK framework, particularly T1083: File and Directory Discovery, where adversaries search for specific files or directories on compromised systems. Furthermore, it relates to T1567: Exfiltration Over Web Service, as the attacker utilizes a legitimate application feature to transport stolen data out of the network in a format that may evade detection by security monitoring tools focused on standard web traffic patterns. The ability to read arbitrary files also facilitates further reconnaissance and lateral movement within an environment where Node.js applications are deployed, potentially leading to full system compromise if combined with other vulnerabilities or misconfigurations.
To mitigate this vulnerability, organizations must immediately upgrade exceljs-hardened to version 5.0.0 or later, which includes patches for input validation and path normalization logic. For environments unable to update immediately, implementing a strict allowlist of permitted directories at the application layer is essential. Developers should ensure that any file paths passed to image insertion functions are resolved using secure methods such as Node.js built-in path resolution utilities with explicit checks against directory traversal sequences. Additionally, running Node.js processes under restricted user accounts with minimal filesystem permissions can limit the blast radius if an exploitation attempt occurs. Regular security audits and static code analysis tools configured to detect CWE-22 patterns should be integrated into the development lifecycle to prevent similar issues in future releases.