Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
35 results
Oct 22, 2026PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.CVE-2026-108360 · Websites & servers · PHPOffice · reported by GitHubMedium 6.4
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Worksheet\Drawing::setPath validates only the initial external-image URL with setIsWhitelisted when setAllowExternalImages is enabled. The HTTP stream context permits PHP to follow a redirect without applying the callback to the redirected URL, so a permitted image host can redirect the server to an internal address and cause a blind GET request. The response body is not returned to the attacker because the reader validates the downloaded content as an image and removes the temporary file, but internal GET-driven endpoints, network reachability, and cloud metadata endpoints may be reached. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.CVE-2026-108359 · Websites & servers · PHPOffice · reported by GitHubHigh 8.7
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Ods::processTableRow in src/PhpSpreadsheet/Reader/Ods.php accepts an unbounded table:number-rows-repeated attribute from an ODS table row. When the row contains a value, the reader materializes a cell for every repetition without checking the spreadsheet row limit, so a small attacker-controlled ODS file can consume substantial CPU and memory and terminate the PHP worker. Column repetition is separately bounded and is not part of this vulnerability. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.CVE-2026-108358 · Websites & servers · PHPOffice · reported by GitHubHigh 8.8
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that accounts for NUL-byte interleaving but not ISO-2022 escape sequences in XLSX XML parts. The escape sequences prevent the scanner from matching the declaration, and XML charset normalization then removes the escape bytes before parsing, exposing a valid DOCTYPE and entity definitions. Processing an attacker-controlled XLSX can therefore cause entity-expansion denial of service on supported PHP versions and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.CVE-2026-108357 · Websites & servers · PHPOffice · reported by GitHubHigh 8.8
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored SpreadsheetML XML through XmlScanner::scan in Xml::canRead and Xml::trySimpleXMLLoadStringPrivate, while Xml::unentity decodes numeric entities only after each DOCTYPE pattern check. A double-encoded less-than character is reduced by the first callback to another encoded character and by the second callback to a literal less-than sign, so SimpleXML receives an unchecked DOCTYPE and entity declaration. Processing attacker-controlled SpreadsheetML XML can cause entity-expansion denial of service and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 3.10.8 and 5.10.0.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.CVE-2026-59932 · Websites & servers · PHPOffice · reported by GitHubHigh 7.5
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the Gnumeric reader reads attacker-supplied .gnumeric files into memory and, when the file starts with gzip magic bytes, calls gzdecode() on the full compressed contents without enforcing a decompressed-size limit. A very small compressed .gnumeric file can expand to data larger than the PHP memory limit and crash the process during Gnumeric::canRead() before the file is rejected or fully parsed. This is reachable through normal file-type detection and Gnumeric loading paths, so applications that accept attacker-controlled spreadsheet uploads can suffer denial of service. This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18 and 1.30.6.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.CVE-2026-59933 · Websites & servers · PHPOffice · reported by GitHubHigh 7.5
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A tiny malformed .xls/OLE file can set the small-block depot sector chain to point back to itself. During normal XLS detection, OLERead::read() appends the same sector data repeatedly until the PHP process exhausts memory. This is reachable from Reader\Xls::canRead() and therefore from automatic spreadsheet type detection. Applications that accept attacker-controlled spreadsheet uploads can suffer denial of service from a very small file. This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18 and 1.30.6.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.CVE-2026-59931 · Websites & servers · PHPOffice · reported by GitHubHigh 7.7
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE() domain whitelist can be bypassed via an HTTP redirect (SSRF). In Calculation/Web/Service.php, the webService() method validates a URL's host against the whitelist set via Spreadsheet::setDomainWhiteList(), then fetches content with file_get_contents($url, false, $ctx); because PHP's HTTP stream wrapper follows 301/302 redirects automatically (up to 20 hops) and the redirect target is never re-validated, an attacker who can trigger a redirect from a whitelisted domain can reach arbitrary URLs, including internal addresses. An attacker able to upload XLSX files to an application that uses setDomainWhiteList() and getCalculatedValue() can achieve a full-read SSRF, returning up to 32,767 bytes of the response body as a cell's calculated value, which enables exfiltration of cloud metadata (AWS/GCP/Azure credentials via http://169.254.169.254/), access to internal-only services, and internal port scanning (the port is not validated). This issue has bee
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2026PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.CVE-2026-45034 · Websites & servers · PHPOffice · reported by GitHubCritical 9.2
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.5, CVE-2026-34084 was patched by the helper File::prohibitWrappers. The helper calls parse_url($filename, PHP_URL_SCHEME) and then checks is_string($scheme) && strlen($scheme) > 1 to reject stream wrappers such as phar://, php://, data:// or expect://. The check is not equivalent to "does the path contain a wrapper". When the input has the form phar:///path/file.phar/inner with three or more slashes after the scheme, parse_url returns boolean false instead of returning the scheme string. The is_string($scheme) branch is therefore skipped, the helper returns without throwing, and the caller proceeds. PHP's stream layer, however, still treats phar:///... as a valid phar wrapper and opens the underlying phar file. The result is that IOFactory::load($attackerPath) walks past the patch and still touches the phar wrapper. On PHP 7.x, simply reaching the phar wrapper via is_file is enough for PHP to automatically deserialize the phar metadata, which in turn invokes the magic methods __wakeup and __destruct of an attacker controlled object and gives full RCE. On PHP 8.x, automatic metadata deseria
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.CVE-2026-40902 · Websites & servers · PHPOffice · reported by GitHubHigh 7.5
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the XLSX reader's ColumnAndRowAttributes::readRowAttributes() method reads row numbers from XML attributes without validating them against the spreadsheet maximum row limit (AddressRange::MAX_ROW = 1,048,576). An attacker can craft a minimal XLSX file (~1.6KB) containing a <row r="999999999"/> element that inflates cachedHighestRow to 999,999,999, causing any subsequent row iteration to attempt ~1 billion loop cycles and exhaust CPU resources. This vulnerability is fixed in 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.CVE-2026-40863 · Websites & servers · PHPOffice · reported by GitHubHigh 7.5
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the SpreadsheetML XML reader (Reader\Xml) does not validate the ss:Index row attribute against the maximum allowed row count (AddressRange::MAX_ROW = 1,048,576). An attacker can craft a SpreadsheetML XML file with ss:Index="999999999" on a <Row> element, which inflates the internal cachedHighestRow to ~1 billion. Any subsequent call to getRowIterator() without an explicit end row will attempt to iterate ~1 billion rows, causing CPU exhaustion and denial of service. This vulnerability is fixed in 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2026PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.CVE-2026-40296 · Websites & servers · PHPOffice · reported by GitHubMedium 5.4
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The HTML writer skips htmlspecialchars escaping when a cell's formatted value differs from the original value. When a cell has a custom number format containing the text placeholder @ along with any additional literal characters (for example ". @", "@ ", or "x@"), the formatter replaces @ with the cell value and adds the extra characters, causing the formatted value to differ from the original and bypassing HTML escaping entirely. An attacker who can control the cell value and number format of an uploaded spreadsheet that is later converted to HTML and displayed to other users can achieve stored cross-site scripting. This issue is fixed in versions 5.7.0, 3.10.5, 2.4.5, 2.1.16, and 1.30.4.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2026PhpSpreadsheet is a library for reading and writing spreadsheet files.CVE-2026-35453 · Websites & servers · PHPOffice · reported by GitHubMedium 4.8
PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.3 and earlier, 2.0.0 through 2.1.15, 2.2.0 through 2.4.4, 3.3.0 through 3.10.4, and 4.0.0 through 5.6.0, the HTML Writer skips htmlspecialchars() output escaping when a cell uses a custom number format containing the @ text placeholder with additional literal text (e.g., @ "items"). The escaping is only applied when the formatted output strictly equals the original cell value. When the format code contains @ with quoted literal text, the formatter substitutes the raw cell value into the format string and returns early without invoking the escaping callback. An attacker who can control cell content in a spreadsheet processed by the HTML Writer can inject arbitrary HTML and JavaScript into the generated output. This issue has been fixed in versions 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2026PhpSpreadsheet is a library for reading and writing spreadsheet files.CVE-2026-34084 · Websites & servers · PHPOffice · reported by GitHubCritical 9.2
PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.2 and earlier, 2.0.0 through 2.1.14, 2.2.0 through 2.4.3, 3.3.0 through 3.10.3, and 4.0.0 through 5.5.0, when the filename argument to IOFactory::load() is user-controlled, an attacker can supply a PHP stream wrapper path (such as phar://, ftp://, or ssh2.sftp://) that passes the is_file() check in File::assertFile(). The phar:// wrapper triggers deserialization of the PHAR metadata, which can lead to remote code execution if a suitable gadget chain is available in the application. The ftp:// and ssh2.sftp:// wrappers can be used for server-side request forgery. This issue has been fixed in versions 1.30.3, 2.1.15, 2.4.4, 3.10.4, and 5.6.0.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2025PhpOffice/PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.CVE-2025-54370 · Websites & servers · PHPOffice · reported by GitHubHigh 8.7
PhpOffice/PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to versions 1.30.0, 2.1.12, 2.4.0, 3.10.0, and 5.0.0, SSRF can occur when a processed HTML document is read and displayed in the browser. The vulnerability lies in the setPath method of the PhpOffice\PhpSpreadsheet\Worksheet\Drawing class, where a crafted string from the user is passed to the HTML reader. This issue has been patched in versions 1.30.0, 2.1.12, 2.4.0, 3.10.0, and 5.0.0.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2025phpoffice/phpspreadsheet is a pure PHP library for reading and writing spreadsheet files.CVE-2025-23210 · Websites & servers · PHPOffice · reported by GitHubMedium 4.8
phpoffice/phpspreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions have been found to have a Bypass of the Cross-site Scripting (XSS) sanitizer using the javascript protocol and special characters. This issue has been addressed in versions 3.9.0, 2.3.7, 2.1.8, and 1.29.9. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2025PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.CVE-2025-22131 · Websites & servers · PHPOffice · reported by GitHubMedium 5.1
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Cross-Site Scripting (XSS) vulnerability in the code which translates the XLSX file into a HTML representation and displays it in the response.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2025PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.CVE-2024-56412 · Websites & servers · PHPOffice · reported by GitHubMedium 4.8
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to bypass of the cross-site scripting sanitizer using the javascript protocol and special characters. An attacker can use special characters, so that the library processes the javascript protocol with special characters and generates an HTML link. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2025PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.CVE-2024-56411 · Websites & servers · PHPOffice · reported by GitHubMedium 4.8
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have a cross-site scripting (XSS) vulnerability of the hyperlink base in the HTML page header. The HTML page is formed without sanitizing the hyperlink base. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2025PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.CVE-2024-56410 · Websites & servers · PHPOffice · reported by GitHubMedium 4.8
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have a cross-site scripting (XSS) vulnerability in custom properties. The HTML page is generated without clearing custom properties. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2025PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.CVE-2024-56409 · Websites & servers · PHPOffice · reported by GitHubHigh 8.3
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the `Currency.php` file. Using the `/vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Currency.php` script, an attacker can perform a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2025PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.CVE-2024-56366 · Websites & servers · PHPOffice · reported by GitHubHigh 8.3
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the `Accounting.php` file. Using the `/vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Accounting.php` script, an attacker can perform a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2025PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.CVE-2024-56365 · Websites & servers · PHPOffice · reported by GitHubHigh 8.3
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the constructor of the `Downloader` class. Using the `/vendor/phpoffice/phpspreadsheet/samples/download.php` script, an attacker can perform a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2025PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.CVE-2024-56408 · Websites & servers · PHPOffice · reported by GitHubHigh 8.3
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have no sanitization in the `/vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.php` file, which leads to the possibility of a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2024PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.CVE-2024-48917 · Websites & servers · PHPOffice · reported by GitHubHigh 7.5
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. The `XmlScanner` class has a scan method which should prevent XXE attacks. However, in a bypass of the previously reported `CVE-2024-47873`, the regexes from the `findCharSet` method, which is used for determining the current encoding can be bypassed by using a payload in the encoding UTF-7, and adding at end of the file a comment with the value `encoding="UTF-8"` with `"`, which is matched by the first regex, so that `encoding='UTF-7'` with single quotes `'` in the XML header is not matched by the second regex. An attacker can bypass the sanitizer and achieve an XML external entity attack. Versions 1.9.4, 2.1.3, 2.3.2, and 3.4.0 fix the issue.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2024PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.CVE-2024-47873 · Websites & servers · PHPOffice · reported by GitHubHigh 7.5
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. The XmlScanner class has a scan method which should prevent XXE attacks. However, prior to versions 1.9.4, 2.1.3, 2.3.2, and 3.4.0, the regexes used in the `scan` method and the findCharSet method can be bypassed by using UCS-4 and encoding guessing. An attacker can bypass the sanitizer and achieve an XML external entity attack. Versions 1.9.4, 2.1.3, 2.3.2, and 3.4.0 fix the issue.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files.CVE-2024-45291 · Websites & servers · PHPOffice · reported by GitHubMedium 6.3
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file that links images from arbitrary paths. When embedding images has been enabled in HTML writer with `$writer->setEmbedImages(true);` those files will be included in the output as `data:` URLs, regardless of the file's type. Also URLs can be used for embedding, resulting in a Server-Side Request Forgery vulnerability. When embedding images has been enabled, an attacker can read arbitrary files on the server and perform arbitrary HTTP GET requests. Note that any PHP protocol wrappers can be used, meaning that if for example the `expect://` wrapper is enabled, also remote code execution is possible. This issue has been addressed in release versions 1.29.2, 2.1.1, and 2.3.0. All users are advised to upgrade. there are no known workarounds for this vulnerability.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files.CVE-2024-45290 · Websites & servers · PHPOffice · reported by GitHubHigh 7.7
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file which links media from external URLs. When opening the XLSX file, PhpSpreadsheet retrieves the image size and type by reading the file contents, if the provided path is a URL. By using specially crafted `php://filter` URLs an attacker can leak the contents of any file or URL. Note that this vulnerability is different from GHSA-w9xv-qf98-ccq4, and resides in a different component. An attacker can access any file on the server, or leak information form arbitrary URLs, potentially exposing sensitive information such as AWS IAM credentials. This issue has been addressed in release versions 1.29.2, 2.1.1, and 2.3.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files.CVE-2024-45060 · Websites & servers · PHPOffice · reported by GitHubHigh 7.1
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. One of the sample scripts in PhpSpreadsheet is susceptible to a cross-site scripting (XSS) vulnerability due to improper handling of input where a number is expected leading to formula injection. The code in in `45_Quadratic_equation_solver.php` concatenates the user supplied parameters directly into spreadsheet formulas. This allows an attacker to take control over the formula and output unsanitized data into the page, resulting in JavaScript execution. This issue has been addressed in release versions 1.29.2, 2.1.1, and 2.3.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files.CVE-2024-45293 · Websites & servers · PHPOffice · reported by GitHubHigh 7.5
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The security scanner responsible for preventing XXE attacks in the XLSX reader can be bypassed by slightly modifying the XML structure, utilizing white-spaces. On servers that allow users to upload their own Excel (XLSX) sheets, Server files and sensitive information can be disclosed by providing a crafted sheet. The security scan function in src/PhpSpreadsheet/Reader/Security/XmlScanner.php contains a flawed XML encoding check to retrieve the input file's XML encoding in the toUtf8 function. The function searches for the XML encoding through a defined regex which looks for `encoding="*"` and/or `encoding='*'`, if not found, it defaults to the UTF-8 encoding which bypasses the conversion logic. This logic can be used to pass a UTF-7 encoded XXE payload, by utilizing a whitespace before or after the = in the attribute definition. Sensitive information disclosure through the XXE on sites that allow users to upload their own excel spreadsheets, and parse them using PHPSpreadsheet's Excel parser. This issue has been addressed in release versions 1.29.1, 2.1.1, and 2.3.0. All users are advised to upgrade. Th
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files.CVE-2024-45292 · Websites & servers · PHPOffice · reported by GitHubMedium 5.4
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. `\PhpOffice\PhpSpreadsheet\Writer\Html` does not sanitize "javascript:" URLs from hyperlink `href` attributes, resulting in a Cross-Site Scripting vulnerability. This issue has been addressed in release versions 1.29.2, 2.1.1, and 2.3.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2024PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files.CVE-2024-45048 · Websites & servers · PHPOffice · reported by GitHubHigh 8.8
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions are subject to a bypassing of a filter which allows for an XXE-attack. This in turn allows attacker to obtain contents of local files, even if error reporting is muted. This vulnerability has been addressed in release version 2.2.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2024PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files.CVE-2024-45046 · Websites & servers · PHPOffice · reported by GitHubMedium 5.4
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In affected versions `\PhpOffice\PhpSpreadsheet\Writer\Html` doesn't sanitize spreadsheet styling information such as font names, allowing an attacker to inject arbitrary JavaScript on the page. As a result an attacker may used a crafted spreadsheet to fully takeover a session of a user viewing spreadsheet files as HTML. This issue has been addressed in release version 2.1.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2020This affects the package phpoffice/phpspreadsheet from 0.0.0.CVE-2020-7776 · Websites & servers · Phpoffice · reported by report@snyk.ioHigh 7.1
This affects the package phpoffice/phpspreadsheet from 0.0.0. The library is vulnerable to XSS when creating an html output from an excel file by adding a comment on any cell. The root cause of this issue is within the HTML writer where user comments are concatenated as part of link and this is returned as HTML. A fix for this issue is available on commit 0ed5b800be2136bcb8fa9c1bdf59abc957a98845/master branch.
- Product
- Phpspreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2019PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue.CVE-2019-12331 · Websites & servers · Phpoffice · reported by MITREHigh 8.8
PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared in the header. This was a security measurement to prevent CVE-2018-19277 but the fix is not sufficient. By double-encoding the the xml payload to utf-7 it is possible to bypass the check for the string ‚<!ENTITY‘ and thus allowing for an xml external entity processing (XXE) attack.
- Product
- Phpspreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comherolab.usd.de
Nov 14, 2018securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx fileCVE-2018-19277 · Websites & servers · Phpoffice · reported by MITREHigh 8.8
securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file
- Product
- Phpspreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.