CVE-2024-47875-PhpSpreadsheet-XSS-PoC

CVE-2025-22131 • PhpSpreadsheet HTML Writer XSS PoC Over View this is a PoC on the CVE-2025-22131 , a Cross-Site Scripting XSS vulnerability in PhpSpreadsheet versions prior to 2.2.2, 2.1.2, and 1.29.4. The vulnerability resides in the generateNavigation function, which fails to sanitize sheet...

CVE-2025-22131-PoC

CVE-2025-22131-PoC PoC for CVE-2025-22131 PhpSpreadsheet is a library written in pure PHP and offers a set of classes that allow you to read and write various spreadsheet file formats such as Excel and LibreOffice Calc. phpspreadsheet version =2.2.0, =2.0.0, =3.0.0, sheetIndex === null $sheets =...

GHSA-2PHH-27FW-Q4GC PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading

Summary PhpSpreadsheet's Worksheet\Drawing::setPath validates an external-image URL against an operator-supplied isWhitelisted callback once, on the initial URL only, then fetches it with filegetcontents using a stream context that does not set followlocation = 0. A whitelisted host that returns ...

PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading

Summary PhpSpreadsheet's Worksheet\Drawing::setPath validates an external-image URL against an operator-supplied isWhitelisted callback once, on the initial URL only, then fetches it with filegetcontents using a stream context that does not set followlocation = 0. A whitelisted host that returns ...

EUVD-2026-108264

PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading...

GHSA-J2W7-387V-M2RQ PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)

Summary When PhpSpreadsheet loads an OpenDocument Spreadsheet .ods, Ods::processTableRow reads the table:number-rows-repeated attribute of a with an unchecked int cast, then materialises one cell per repeated row. This value is completely unbounded, so a single 1.4 KB file can instruct the reader...

PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)

Summary When PhpSpreadsheet loads an OpenDocument Spreadsheet .ods, Ods::processTableRow reads the table:number-rows-repeated attribute of a with an unchecked int cast, then materialises one cell per repeated row. This value is completely unbounded, so a single 1.4 KB file can instruct the reader...

EUVD-2026-108267

PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion DoS...

GHSA-3X94-M842-937C PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service

Summary PhpSpreadsheet's XmlScanner::scan uses a regex pattern that only accounts for NULL byte 0x00 interleaving when detecting !DOCTYPE. ISO-2022 escape sequences 0x1B bytes inserted between the characters of the pattern break the regex match entirely, allowing DOCTYPE declarations with entity...

EUVD-2026-108265

PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service...

PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service

Summary PhpSpreadsheet's XmlScanner::scan uses a regex pattern that only accounts for NULL byte 0x00 interleaving when detecting !DOCTYPE. ISO-2022 escape sequences 0x1B bytes inserted between the characters of the pattern break the regex match entirely, allowing DOCTYPE declarations with entity...

PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service

Summary The SpreadsheetML XML reader Reader\Xml scans file content twice through XmlScanner::scan, and each scan runs an unentity callback that calls htmlentitydecode after the pattern check. By double-encoding the toUtf8$xml; if pregmatch$pattern, $xml // CHECK 2 UTF-8 throw new Exception'Detect...

GHSA-RXJ4-H86G-25GC PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service

Summary The SpreadsheetML XML reader Reader\Xml scans file content twice through XmlScanner::scan, and each scan runs an unentity callback that calls htmlentitydecode after the pattern check. By double-encoding the toUtf8$xml; if pregmatch$pattern, $xml // CHECK 2 UTF-8 throw new Exception'Detect...

EUVD-2026-108242

PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity TOCTOU Allows XXE and Denial of Service...

CVE-2026-45034

🧨 PHPSpreadsheet Phar Deserialization Exploit BypassprohibitWrappers + Remote Code Execution RCE on phpoffice/phpspreadsheet This repository provides a proof-of-concept PoC exploit for a critical vulnerability in the popular PHP library PHPSpreadsheet. The attack abuses the phar:// wrapper to...

CVE-2024-45427-Exploit

CVE-2024-45427 Exploit Generator This script generates a malicious Excel .xlsx file to exploit CVE-2024-45427 in PhpSpreadsheet library v3.7.0. It injects an XSS payload into the sheet name by manipulating the raw XML, bypassing standard library validation checks. Usage 1. Edit exploit.py and set...

CVE-2026-86020

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing...

EUVD-2026-108580

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing...

CVE-2026-86020 Part-DB: Spreadsheet Formula Injection in XLSX Part Exports

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing...

CVE-2026-86020 Part-DB: Spreadsheet Formula Injection in XLSX Part Exports

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing...