CVE-2026-128347 | ExcelJS up to 4.4.0 Streaming WorkbookWriter addImage path traversal

November 13, 2026 Yanac

A vulnerability classified as problematic has been found in ExcelJS up to 4.4.0. Affected by this issue is the function addImage of the component Streaming WorkbookWriter. The manipulation leads to path traversal.

This vulnerability is traded as CVE-2026-128347. It is possible to initiate the attack remotely. There is no exploit available.VulDB Recent EntriesRead More