CVE-2026-78208: exceljs through 4.4.0 Path Traversal via Unvalidated addImage filename

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-24 · updated 2026-10-14
Weakness: CWE-73

Description

exceljs through 4.4.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook.

Affected products

exceljs: through 4.4.0

References

https://github.com/exceljs/exceljs
https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/workbook.js#L142-L147
https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xlsx.js#L421-L429
https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-m8mg-8574-gm3m
https://www.vulncheck.com/advisories/exceljs-through-path-traversal-via-unvalidated-addimage-filename

Get alerted when CVE-2026-78208 or the next vulnerability affects your stack