CVE-2024-42485: Filament Excel Vulnerable to Path Traversal Attack on Export Download Endpoint

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-08-12 · updated 2026-06-17
Weakness: CWE-22

Description

Filament Excel enables excel export for Filament admin resources. The export download route `/filament-excel/{path}` allowed downloading any file without login when the webserver allows `../` in the URL. Patched with Version v2.3.3.

Affected products

pxlrbt filament-excel: from 1.0.0 before 1.1.14; from 2.0.0 before 2.3.3 — fixed in 1.1.14, 2.3.3

How to fix

Upgrade to a fixed version: pxlrbt filament-excel 1.1.14, 2.3.3. Check the vendor advisory for mitigations.

References

https://github.com/pxlrbt/filament-excel/commit/bda42891a4b0c15d5dab5da8c53a006ddadccfb7
https://github.com/pxlrbt/filament-excel/security/advisories/GHSA-m3px-vjxr-fx4m

Get alerted when CVE-2024-42485 or the next vulnerability affects your stack