A path traversal vulnerability exists in Laravel Excel (Maatwebsite/Laravel-Excel) versions 3.1.8 through 3.1.69 in the Disk::copy() method within src/Files/Disk.php. The method resolves caller-controlled destination paths using realpath() against the process working directory rather than the configured Flysystem filesystem disk, bypassing path confinement. If the resolved path points to an existing writable file, the method opens it with fopen() in rb+ mode and overwrites it using stream_copy_to_stream(). This allows attackers who control export destination paths to overwrite arbitrary files on the server. The rb+ mode results in non-truncating overwrites, leaving trailing bytes when the new content is shorter. Overwriting executable PHP files can result in remote code execution. The vulnerability is exploitable via Excel::store(), $export->store(), or storeExcel() methods. The issue has been patched in version 3.1.70.