An unauthenticated remote attacker can perform path traversal attacks against applications using the exceljs library, potentially leading to unauthorized file system access.

This vulnerability, classified as CWE-73, arises from the lack of validation for file names passed to the addImage function. An unauthenticated attacker can exploit this to traverse directories and potentially access sensitive files on the host system.

The ability to access arbitrary files on the system presents a critical security risk, potentially leading to the exposure of configuration files, credentials, or sensitive application data. With a CVSS score of 7.5, this vulnerability requires immediate attention to prevent unauthorized information disclosure.

Immediate Action: Update the exceljs dependency to the latest secure version once released, or apply the specific patch provided in the vendor security advisory.

Proactive Monitoring: Review application access logs for suspicious file paths or directory traversal patterns, such as sequences containing dot-dot-slash.

Compensating Controls: Ensure that the application process runs with the least privilege necessary, isolating it from sensitive areas of the file system.

Public Exploit Available: No

Given the potential for unauthorized file access, administrators should treat this vulnerability as a high priority. Ensure that all inputs into the exceljs library are validated and that the software is updated to the latest version to eliminate the underlying path handling flaw.