CVE-2026-78208 Overview
CVE-2026-78208 is a path traversal vulnerability [CWE-73] in the exceljs-hardened Node.js library affecting all versions prior to 5.0.0. The flaw resides in the Workbook.addImage() function, which fails to validate file paths supplied by callers. Attackers who control the filename argument can supply arbitrary paths and cause the library to read any file accessible to the Node.js process. The referenced file contents are then embedded inside the generated XLSX workbook, exposing sensitive data such as configuration files, credentials, and private keys.
Critical Impact
Remote, unauthenticated attackers who can influence image filenames passed to Workbook.addImage() can exfiltrate arbitrary readable files from the host by embedding them into the resulting workbook.
Affected Products
- exceljs-hardened versions prior to 5.0.0
- Node.js applications invoking Workbook.addImage() with attacker-influenced filenames
- Upstream exceljs code paths referenced in lib/doc/workbook.js and lib/xlsx/xlsx.js
Discovery Timeline
- 2026-08-24 - CVE-2026-78208 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-78208
Vulnerability Analysis
The vulnerability exists in the Workbook.addImage() API surface of exceljs-hardened. When callers pass an image via a filename property, the library reads the file from disk and embeds its bytes into the XLSX archive under xl/media/. The library does not canonicalize the supplied path, restrict it to an approved base directory, or validate the file extension against expected image formats.
An attacker who controls the filename value can supply absolute paths such as /etc/passwd or relative traversal sequences such as ../../../../etc/shadow. The Node.js process reads whatever file the operating system permits, and the resulting workbook contains the raw file bytes packaged as an image resource. Downloading and unzipping the XLSX yields the exfiltrated content directly.
Root Cause
The root cause is external control of a file name or path without validation [CWE-73]. Workbook.addImage() accepts the caller-supplied filename and passes it directly to filesystem read routines used during workbook serialization. See the upstream references at ExcelJS workbook.js lines 142-147 and ExcelJS xlsx.js lines 421-429 for the code paths inherited by the hardened fork prior to version 5.0.0.
Attack Vector
Exploitation requires that untrusted input reach the filename argument of Workbook.addImage(). Common patterns include web applications that generate reports from user-supplied templates, multi-tenant SaaS products that let tenants specify branding images by path, and pipelines that build workbooks from JSON configuration accepted over the network. No authentication or user interaction is required when the vulnerable endpoint is reachable. The attacker submits a crafted request, receives the generated workbook, and extracts the target file from the archive's media directory.
Refer to the GitHub Security Advisory GHSA-m8mg-8574-gm3m and the VulnCheck ExcelJS Path Traversal Advisory for further technical detail.
Detection Methods for CVE-2026-78208
Indicators of Compromise
- Generated XLSX archives containing entries in xl/media/ whose byte signatures do not match known image formats such as PNG, JPEG, or GIF.
- Application logs recording calls to Workbook.addImage() with filename values containing ../, absolute paths, or references to sensitive locations such as /etc/, ~/.ssh/, or Windows C:\Users\.
- Outbound file downloads whose sizes correlate with sensitive host files rather than legitimate image assets.
Detection Strategies
- Perform software composition analysis to inventory Node.js projects that declare exceljs-hardened at versions below 5.0.0 in package.json or package-lock.json.
- Instrument the application to log every filename argument passed to Workbook.addImage() and alert on path traversal sequences or paths outside the intended asset directory.
- Add runtime file access monitoring on the Node.js process user to flag reads of non-media files immediately preceding XLSX generation.
Monitoring Recommendations
- Track outbound XLSX responses from report and export endpoints for anomalously large media entries or non-image content types.
- Correlate web request parameters that influence workbook generation with subsequent filesystem access events on the host.
- Review third-party dependency advisories continuously and route new exceljs-hardened CVEs to the responsible service owners.
How to Mitigate CVE-2026-78208
Immediate Actions Required
- Upgrade exceljs-hardened to version 5.0.0 or later across all Node.js services and rebuild container images.
- Audit application code for any invocation of Workbook.addImage() and confirm the filename argument is never derived from untrusted input.
- If untrusted input is unavoidable, validate that resolved paths remain inside an allow-listed asset directory using path.resolve() comparisons.
Patch Information
The maintainer released exceljs-hardened 5.0.0, which adds validation to reject path traversal sequences and constrain image reads to safe locations. See the GitHub Security Advisory GHSA-m8mg-8574-gm3m for the fix details and version guidance.
Workarounds
- Prefer the buffer form of addImage() and load image bytes in application code with an explicit allow-list of files.
- Enforce a canonical base directory check that rejects any resolved path outside ./assets/images/ or an equivalent trusted location.
- Run the Node.js process under a dedicated low-privilege user with filesystem access restricted to required directories only.
# Configuration example: upgrade the vulnerable package
npm install exceljs-hardened@^5.0.0
npm audit --production
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
