exceljs-hardened before 5.0.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook.

CVE-2026-78208 describes a path traversal vulnerability in the exceljs-hardened Node.js library affecting versions before 5.0.0. The vulnerability exists in the Workbook.addImage() function, which fails to validate or sanitize file paths supplied by the caller. An attacker who can influence the file path argument can read arbitrary files accessible to the Node.js process and embed their contents into a generated Excel workbook, potentially exposing sensitive server-side data. The vulnerability is rooted in the underlying exceljs library code found in workbook.js and xlsx.js. A fix was introduced in exceljs-hardened version 5.0.0. The issue is documented in a GitHub security advisory (GHSA-m8mg-8574-gm3m) and covered by VulnCheck. Developers using exceljs or exceljs-hardened should upgrade immediately and validate file path inputs before passing them to addImage().