Path Traversal in Excel Image Embedding Allows Arbitrary File Read

CVE-2026-78208 is a path traversal vulnerability in the exceljs-hardened library's Workbook.addImage() function that fails to sanitize file paths before processing. This allows attackers to read arbitrary files accessible to the Node.js process by crafting malicious file paths—such as "../../../../etc/passwd"—which are then embedded into generated Excel workbooks. Organizations using vulnerable versions (before 5.0.0) of this popular Node.js library are at risk, particularly those building server-side Excel generation services, report generation pipelines, or any application that accepts user-controlled image paths. The impact extends beyond simple information disclosure; compromised files could contain sensitive configuration data, credentials, or intellectual property embedded in workbooks that users download and share.

While this CVE doesn't map directly to MITRE ATT&CK techniques, Casky's 754 security skills—powered by Claude AI's extended reasoning—would detect the attack patterns associated with CWE-73 (External Control of File Name or Path) through behavioral analysis of input validation failures and file access anomalies. Practitioners using Casky would observe findings related to: unsanitized user input flowing into file operations, path construction without canonicalization checks, and access to files outside intended directories. The platform's skill set would flag suspicious patterns in code analysis where user-supplied parameters directly influence file paths, correlate these with data exfiltration patterns, and identify the absence of path normalization controls—enabling teams to catch this vulnerability class during code review or runtime monitoring before exploitation occurs.