{"id":"CVE-2026-128347","aliases":[],"cve":{"records":[{"id":"CVE-2026-128347","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-13T01:20:43.575Z","published":"2026-11-13T09:33:31.024Z","modified":"2026-11-13T22:31:42.092Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-13T09:33:31.024Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-13T22:31:42.092Z"}],"references":[{"url":"https://github.com/exceljs/exceljs","tags":["product"],"source":"VulnCheck"},{"url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-f9m8-8qmf-qq29","tags":["third-party-advisory"],"source":"VulnCheck"},{"url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/stream/xlsx/workbook-writer.js#L230-L237","tags":["technical-description"],"source":"VulnCheck"},{"url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/stream/xlsx/workbook-writer.js#L124-L130","tags":["technical-description"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-arbitrary-file-read-via-workbookwriter-addimage-filename","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-73","description":"External Control of File Name or Path","source":"VulnCheck"}],"applicability":[{"source":"VulnCheck","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:exceljs_project:exceljs:*:*:*:*:*:*:*:*","versionEndIncluding":"4.4.0"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-13T16:34:12.560799Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"ExcelJS through 4.4.0 Arbitrary File Read via WorkbookWriter addImage Filename","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"ExcelJS through 4.4.0 contains an arbitrary file read vulnerability in the streaming WorkbookWriter that allows attackers to read local files by supplying crafted image filenames to addImage. Attackers can inject ../ path segments into user-controlled image paths, causing addMedia to embed any file readable by the Node.js process under xl/media in the generated workbook.","score":8.7,"severity":"high","published":"2026-11-13T09:33:31.024Z","modified":"2026-11-13T22:31:42.092Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"exceljs","name":"exceljs","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.4.0","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","packageIdentity":{"ecosystem":"npm","name":"exceljs"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-128347"}],"remediation":[],"references":["https://github.com/exceljs/exceljs","https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-f9m8-8qmf-qq29","https://github.com/exceljs/exceljs/blob/v4.4.0/lib/stream/xlsx/workbook-writer.js#L230-L237","https://github.com/exceljs/exceljs/blob/v4.4.0/lib/stream/xlsx/workbook-writer.js#L124-L130","https://www.vulncheck.com/advisories/exceljs-through-4.4.0-arbitrary-file-read-via-workbookwriter-addimage-filename"],"sources":[{"name":"CVE","id":"CVE-2026-128347","modified":"2026-11-13T22:31:42.092Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-128347"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":8.7},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5}],"sourceAffected":[],"observedAt":"2026-11-13T23:02:14.246Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T00:20:33.177Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-13T23:05:51.070Z","attemptedAt":"2026-11-13T23:05:51.070Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-13T23:05:34.353Z","attemptedAt":"2026-11-13T23:05:34.353Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-13T23:05:35.251Z","attemptedAt":"2026-11-13T23:05:35.251Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-13T23:05:34.008Z","attemptedAt":"2026-11-13T23:05:34.008Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-128347","url":"https://www.first.org/epss/","probability":0.00508,"percentile":0.43977,"date":"2026-11-13","checkedAt":"2026-11-13T23:05:34.008Z"},{"source":"GitHub Advisory Database","id":"GHSA-jf4h-9vf8-6gmp","url":"https://github.com/advisories/GHSA-jf4h-9vf8-6gmp","modified":"2026-11-13T12:31:43Z","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-11-13T23:05:34.353Z"},{"source":"ENISA EUVD","id":"EUVD-2026-125152","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-125152","modified":"Nov 13, 2026, 10:31:42 PM","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","checkedAt":"2026-11-13T23:05:35.251Z"},{"source":"NVD","id":"CVE-2026-128347","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128347","modified":"2026-11-13T15:48:52.237","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-13T23:05:51.070Z"},{"source":"NVD","id":"CVE-2026-128347","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128347","modified":"2026-11-13T15:48:52.237","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-11-13T23:05:51.070Z"}],"aiSummary":{"text":"ExcelJS through 4.4.0 has an arbitrary file read vulnerability via WorkbookWriter addImage filename, allowing attackers to read local files by injecting ../ path segments. The weakness is due to external control of file name or path. The impact is limited to files readable by the Node.js process.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-13T23:06:11.140Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-128347"}]}}