GHSA-m3px-vjxr-fx4m

Filament Excel Vulnerable to Path Traversal Attack on Export Download Endpoint

Source: GitHub Advisory Database (reviewed) High CVE-2024-42485

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	pxlrbt/filament-excel	>= 2.0.0-alpha, < 2.3.3	2.3.3
Packagist	pxlrbt/filament-excel	< 1.1.14	1.1.14

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The export download route `/filament-excel/{path}` allowed downloading any file without login when the webserver allows `../` in the URL. ### Patches Patched with Version v2.3.3 ### Credits Thanks to Kevin Pohl for reporting this.

References

External links from the advisory. They lead to third-party sites.

https://github.com/pxlrbt/filament-excel/security/advisories/GHSA-m3px-vjxr-fx4m web
https://nvd.nist.gov/vuln/detail/CVE-2024-42485 advisory
https://github.com/pxlrbt/filament-excel/commit/af36f933b032aefccc87d17431b6e74673b04af5 web
https://github.com/pxlrbt/filament-excel/commit/bda42891a4b0c15d5dab5da8c53a006ddadccfb7 web
https://github.com/pxlrbt/filament-excel package
https://github.com/pxlrbt/filament-excel/releases/tag/v1.1.14 web