Filament Excel Vulnerable to Path Traversal Attack on Export Download Endpoint

ALTO 7.5CVE-2024-42485 · GHSA-m3px-vjxr-fx4m · Published 12/08/2024 · updated 17/06/2026

In breve

CVE-2024-42485 è una vulnerabilità ALTO (CVSS 7.5) che riguarda pxlrbt/filament-excel, filament excel (pxlrbt).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.57%, superiore al 47.4% delle vulnerabilità.
Correzione: aggiornare a 2.3.3, 1.1.14 o successiva.

Package	Affected versions	Patched versions
pxlrbt/filament-excel Packagist	`≥ 2.0.0-alpha, < 2.3.3< 1.1.14`	`2.3.31.1.14`
filament excel pxlrbt	`≥ 1.0.0, < 1.1.14≥ 2.0.0, < 2.3.3`	`1.1.142.3.3`

Description

Impact

The export download route /filament-excel/{path} allowed downloading any file without login when the webserver allows ../ in the URL.

Patches

Patched with Version v2.3.3

Credits

Thanks to Kevin Pohl for reporting this.

NVD description

Filament Excel enables excel export for Filament admin resources. The export download route `/filament-excel/{path}` allowed downloading any file without login when the webserver allows `../` in the URL. Patched with Version v2.3.3.

References

pxlrbt/filament-excel security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2024-42485 · ADVISORY
pxlrbt/filament-excel commit af36f93 · WEB
pxlrbt/filament-excel commit bda4289 · WEB
pxlrbt/filament-excel · PACKAGE
pxlrbt/filament-excel release v1.1.14 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free