---
id: CVE-2026-78208
title: >-
  exceljs through 4.4.0 contains a path traversal vulnerability in the
  Workbook.addImage() function that fails to validate file paths
summary: >-
  exceljs through 4.4.0 contains a path traversal vulnerability in the
  Workbook.addImage() function that fails to validate file paths. Attackers can
  supply arbitrary file paths to read any file accessible to the Node.js process
  and embed i…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-73
published: '2026-08-24'
updated: '2026-08-29'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-78208'
references:
  - url: 'https://github.com/exceljs/exceljs'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/workbook.js#L142-L147
    label: disclosure@vulncheck.com
  - url: 'https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xlsx.js#L421-L429'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-m8mg-8574-gm3m
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/exceljs-through-path-traversal-via-unvalidated-addimage-filename
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00508
epssPercentile: 0.40827
ingestedAt: '2026-08-29T21:42:33.239Z'
---

## Overview

exceljs through 4.4.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.