| Package | Affected versions | Patched versions |
|---|---|---|
| pxlrbt/filament-excel | ≥ 2.0.0-alpha, < 2.3.3< 1.1.14 | 2.3.31.1.14 |
| filament excel | ≥ 1.0.0, < 1.1.14≥ 2.0.0, < 2.3.3 | 1.1.142.3.3 |
The export download route /filament-excel/{path} allowed downloading any file without login when the webserver allows ../ in the URL.
Patched with Version v2.3.3
Thanks to Kevin Pohl for reporting this.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free