Laravel Excel allows a caller controlled export destination to be resolved against the process working directory instead of the configured filesystem disk, bypassing Flysystem path confinement. This means an attacker who supplies a controlled file name or path can cause the library to overwrite any writable file in the working directory. The overwrite occurs in rb+ mode, which does not truncate and may leave trailing bytes in the target file, potentially corrupting it or enabling code injection if the overwritten file is an executable, such as a PHP script. The vulnerability is present in Laravel-Excel versions 3.1.8 through 3.1.69 and was fixed in 3.1.70.

SpartnerNL Laravel-Excel releases from 3.1.8 up to but excluding 3.1.70 are affected. Versions 3.1.70 and later contain the patch that restores proper disk path checks and prevents arbitrary file writes

The CVSS score of 7.5 indicates high severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, suggesting a low current exploitation probability but still a serious risk. The likely attack vector requires an attacker to supply a malicious export path via the application, which is possible if the application accepts user control over the export destination without proper validation. Once the file is overwritten, especially executable scripts, the attacker can achieve remote code execution or persistent code injection.