XML External Entity (XXE) Injection

Overview phpoffice/phpspreadsheet is a Spreadsheet engine that Read, Create and Write Spreadsheet documents in PHP . Affected versions of this package are vulnerable to XML External Entity XXE Injection via the unentity method in src/PhpSpreadsheet/Reader/Xml.php, where HTML entities in XML...

Allocation of Resources Without Limits or Throttling

Overview phpoffice/phpspreadsheet is a Spreadsheet engine that Read, Create and Write Spreadsheet documents in PHP . Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the ODS file reader in src/PhpSpreadsheet/Reader/Ods.php, where the...

XML External Entity (XXE) Injection

Overview phpoffice/phpspreadsheet is a Spreadsheet engine that Read, Create and Write Spreadsheet documents in PHP . Affected versions of this package are vulnerable to XML External Entity XXE Injection via the ODS file reader in src/PhpSpreadsheet/Reader/Ods.php, where the...

Incorrect Authorization

Overview phpoffice/phpspreadsheet is a Spreadsheet engine that Read, Create and Write Spreadsheet documents in PHP . Affected versions of this package are vulnerable to Incorrect Authorization via the ODS file reader in src/PhpSpreadsheet/Reader/Ods.php and the XML scanner in...

CLSA-2026-1786530064 TuxCare security update for phpoffice/phpspreadsheet (2 CVEs)

TuxCare rebuilt phpoffice/phpspreadsheet to address 2 CVEs. Fixed in 4.5.0-p3+tuxcare...

PT-2026-80104

TuxCare rebuilt phpoffice/phpspreadsheet to address 2 CVEs. Fixed in 4.5.0-p3+tuxcare...

PT-2026-73707

TuxCare rebuilt phpoffice/phpspreadsheet to address 1 CVE. Fixed in 4.5.0-p1+tuxcare...

PT-2026-75386

TuxCare rebuilt phpoffice/phpspreadsheet to address 5 CVEs. Fixed in 4.5.0-p2+tuxcare...

CVE-2025-23210

phpoffice/phpspreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions have been found to have a Bypass of the Cross-site Scripting XSS sanitizer using the javascript protocol and special characters. This issue has been addressed in versions 3.9.0, 2.3.7, 2.1....

EUVD-2021-0945

Malware in sbrugna...

CVE-2025-54370

PhpOffice/PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to versions 1.30.0, 2.1.12, 2.4.0, 3.10.0, and 5.0.0, SSRF can occur when a processed HTML document is read and displayed in the browser. The vulnerability lies in the setPath method of the...

CVE-2025-54370: Server-Side Request Forgery (SSRF)

PhpOffice/PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to versions 1.30.0, 2.1.12, 2.4.0, 3.10.0, and 5.0.0, SSRF can occur when a processed HTML document is read and displayed in the browser. The vulnerability lies in the setPath method of the...

CVE-2025-23210

phpoffice/phpspreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions have been found to have a Bypass of the Cross-site Scripting XSS sanitizer using the javascript protocol and special characters. This issue has been addressed in versions 3.9.0, 2.3.7, 2.1....

CVE-2025-23210 Bypass XSS sanitizer using the javascript protocol and special characters in phpoffice/phpspreadsheet

phpoffice/phpspreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions have been found to have a Bypass of the Cross-site Scripting XSS sanitizer using the javascript protocol and special characters. This issue has been addressed in versions 3.9.0, 2.3.7, 2.1....

CVE-2025-23210: Improper Neutralization of Input During Web Page Generation

phpoffice/phpspreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions have been found to have a Bypass of the Cross-site Scripting XSS sanitizer using the javascript protocol and special characters. This issue has been addressed in versions 3.9.0, 2.3.7, 2.1....

Reflected Cross-Site Scripting

phpoffice/phpspreadsheet is vulnerable to Unauthorized Reflected Cross-Site Scripting Reflected XSS. The vulnerability is due to improper input handling in the Currency.php file, allows an attacker to inject and execute malicious scripts...

Security Bulletin: Multiple Vulnerabilities in IBM API Connect

Summary Multiple vulnerabilities were addressed in IBM API Connect v10.0.9.0 Vulnerability Details CVEID:CVE-2024-5535 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a buffer over-read flaw in the SSLselectnextproto API function when calling with an empty supported client...

Cross-Site Scripting (XSS)

phpoffice/phpspreadsheet is vulnerable to a cross-site scripting XSS. The vulnerability is due to improper handling of input where a number is expected, allowing an attacker to perform formula injection through direct concatenation of user-supplied parameters into spreadsheet formulas...

Server Side Request Forgery (SSRF)

phpoffice/phpspreadsheet is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to the ability of an attacker to construct an XLSX file that links images from arbitrary paths, which allows for embedding those files as data: URLs and performing unauthorized HTTP GET requests...

CVE-2024-45292

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. "\PhpOffice\PhpSpreadsheet\Writer\Html" does not sanitize "javascript:" URLs from hyperlink "href" attributes, resulting in a Cross-Site Scripting vulnerability. This issue has been addressed in release versions 1.29....