CVE-2026-78208: Exceljs

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

exceljs through 4.4.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook.

Affected products

• Exceljs Exceljs: up to and including 4.4.0

Published 2026-08-24. Last modified 2026-08-31.