CyberRota Analysis
AI-GeneratedThe Workbook.addImage() function in exceljs-hardened versions prior to 5.0.0 is vulnerable to a path traversal attack due to inadequate file path validation. This allows attackers to supply arbitrary file paths, potentially exposing sensitive files accessible to the Node.js process when generating workbooks. Organizations using affected versions should prioritize patching this vulnerability to mitigate the risk of unauthorized file access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
exceljs through 4.4.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook.