Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\Excel\Files\Disk::copy() method resolves the caller-controlled $destination supplied through Excel::store(), $export->store(), or storeExcel() against the process working directory with realpath() instead of the configured filesystem disk. If the path names an existing writable file, Disk::copy() opens it with fopen() in rb+ mode and uses stream_copy_to_stream(), bypassing Flysystem path confinement and allowing an attacker whose application input controls the export path to overwrite arbitrary existing files with export content. The rb+ behavior creates a non-truncating overwrite and trailing bytes when the new export is shorter, and overwriting an executable PHP file can lead to remote code execution. This issue is fixed in version 3.1.70.

A path traversal vulnerability exists in Laravel Excel (Maatwebsite/Laravel-Excel) versions 3.1.8 through 3.1.69 in the Disk::copy() method within src/Files/Disk.php. The method resolves caller-controlled destination paths using realpath() against the process working directory rather than the configured Flysystem filesystem disk, bypassing path confinement. If the resolved path points to an existing writable file, the method opens it with fopen() in rb+ mode and overwrites it using stream_copy_to_stream(). This allows attackers who control export destination paths to overwrite arbitrary files on the server. The rb+ mode results in non-truncating overwrites, leaving trailing bytes when the new content is shorter. Overwriting executable PHP files can result in remote code execution. The vulnerability is exploitable via Excel::store(), $export->store(), or storeExcel() methods. The issue has been patched in version 3.1.70.