CVE-2026-128347

ExcelJS through 4.4.0 contains an arbitrary file read vulnerability in the streaming WorkbookWriter that allows attackers to read local files by supplying crafted image filenames to addImage. Attackers can inject ../ path segments into user-controlled image paths, causing addMedia to embed any fi...

EUVD-2026-125152

ExcelJS through 4.4.0 contains an arbitrary file read vulnerability in the streaming WorkbookWriter that allows attackers to read local files by supplying crafted image filenames to addImage. Attackers can inject ../ path segments into user-controlled image paths, causing addMedia to embed any fi...

CVE-2026-128347

Versions of ExcelJS through 4.4.0 are vulnerable to an arbitrary file read vulnerability within the streaming WorkbookWriter component. The root cause is the lack of proper sanitization when processing image filenames in the addImage function. An attacker can inject ../ path segments into user-co...