CVE-2024-42485
CVE-2024-42485 · Filament Excel Vulnerable to Path Traversal Attack on Export Download Endpoint
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Filament Excel enables excel export for Filament admin resources. The export download route `/filament-excel/{path}` allowed downloading any file without login when the webserver allows `../` in the URL. Patched with Version v2.3.3.
CVSS 7.5 · High · EPSS 0.6% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
filament-excel
- Versions
- >= 2.0.0-alpha, < 2.3.3: Affected
- < 1.1.14: Affected
No fix published
pxlrbt/filament-excel Packagist
- Versions
- v2.0.0
- v2.0.0-alpha
- v2.0.1
- v2.1.0
- v2.1.1
- v2.1.2
- v2.1.3
- v2.1.4
- v2.1.5
- v2.1.6
- v2.1.7
- v2.1.8
- v2.2.0
- v2.2.1
- v2.2.2
- v2.2.3
- v2.3.0
- v2.3.1
- v2.3.2
- Affected ranges
- ECOSYSTEM: ≥ 2.0.0-alpha, < 2.3.3
Update to 2.3.3
pxlrbt/filament-excel Packagist
- Versions
- 0.1.0
- 0.1.1
- 0.1.2
- 0.1.3
- 0.1.4
- v1.0.0
- v1.0.0-beta
- v1.0.0-beta2
- v1.0.1
- v1.0.2
- v1.1.0
- v1.1.1
- v1.1.10
- v1.1.11
- v1.1.12
- v1.1.13
- v1.1.2
- v1.1.3
- v1.1.4
- v1.1.5
- v1.1.6
- v1.1.7
- v1.1.8
- v1.1.9
- Affected ranges
- ECOSYSTEM: < 1.1.14
Update to 1.1.14