high7.5
CVE-2024-42485
Filament Excel Vulnerable to Path Traversal Attack on Export Download Endpoint
Impact
### Impact The export download route `/filament-excel/{path}` allowed downloading any file without login when the webserver allows `../` in the URL. ### Patches Patched with Version v2.3.3 ### Credits Thanks to Kevin Pohl for reporting this.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | pxlrbt/filament-excel | >= 2.0.0-alpha, < 2.3.3 | 2.3.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pxlrbt | Filament Excel | from 1.0.0 before 1.1.14 from 2.0.0 before 2.3.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/pxlrbt/filament-excel/commit/bda42891a4b0c15d5dab5da8c53a006ddadccfb7
- https://github.com/pxlrbt/filament-excel/security/advisories/GHSA-m3px-vjxr-fx4m
- https://github.com/advisories/GHSA-m3px-vjxr-fx4m
- https://nvd.nist.gov/vuln/detail/CVE-2024-42485
- https://github.com/pxlrbt/filament-excel/commit/af36f933b032aefccc87d17431b6e74673b04af5
- https://github.com/pxlrbt/filament-excel/releases/tag/v1.1.14