High severity7.5NVD Advisory· Published Aug 24, 2026

CVE-2026-78208

Description

exceljs-hardened before 5.0.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Exceljs Project/Exceljsllm-fuzzy
Range: <5.0.0
Mateocallec/exceljs-hardenedllm-create
Range: <5.0.0

Patches

Vulnerability mechanics

References

github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/workbook.jsnvd
github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xlsx.jsnvd
github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-m8mg-8574-gm3mnvd
www.vulncheck.com/advisories/exceljs-through-path-traversal-via-unvalidated-addimage-filenamenvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000