CVE-2024-45293

CVE-2024-45293 involves an XXE in PHPSpreadsheet’s XLSX reader where the security scanner that prevents XXE can be bypassed by whitespace in the XML encoding attribute, allowing a crafted XLSX to disclose server data. The root cause is a flawed XML encoding check in XmlScanner.php that defaults t...

CVE-2024-47873

PhpSpreadsheet's XML scanner contains a bypass that can enable XML External Entity (XXE) attacks. The findCharSet/scan logic can be bypassed by encoding tricks (e.g., UCS-4, UTF-7) and encoding guessing, allowing sanitizers to be circumvented. Affected versions are prior to 1.9.4, 2.1.3, 2.3.2, a...

CVE-2020-7776

CVE-2020-7776 affects phpoffice/phpspreadsheet (0.0.0 and earlier): the HTML writer concatenates user comments into links when exporting to HTML from an Excel file, enabling XSS in HTML output. Root cause: HTML writer handling of cell comments. A fix is available in commit 0ed5b800be2136bcb8fa9c1...

CVE-2024-48917

CVE-2024-48917 (PhpSpreadsheet XXE bypass) : The XmlScanner in PhpSpreadsheet can be bypassed via the encoding detection logic (findCharSet) when processing XML with UTF-7 payloads, allowing an XML External Entity attack. A comment injection at the end of the file encoding tag (e.g., encoding="UT...

CVE-2024-45060

Summary (CVE-2024-45060) PhpSpreadsheet (PHPOffice) contains a cross-site scripting (XSS) vulnerability in a sample file. The issue arises when user-supplied input is concatenated directly into spreadsheet formulas in the 45_Quadratic_equation_solver.php script, enabling formula injection and Jav...

CVE-2026-40902

CVE-2026-40902 affects PhpSpreadsheet’s XLSX reader. The vulnerability arises when ColumnAndRowAttributes::readRowAttributes() reads the row index (r attribute) from XML without validating against the maximum row limit (AddressRange::MAX_ROW = 1,048,576). An attacker can craft a tiny XLSX file co...

CVE-2024-45290

PhpSpreadsheet (PHPSpreadsheet) is affected by CVE-2024-45290 through its XLSX reading flow. When opening an XLSX, the library may pass a URL path to the image-dimension/TYPE check, and with crafted php://filter URLs, an attacker can leak file contents or remote resources. The underlying root cau...

CVE-2026-40863

CVE-2026-40863 affects PhpSpreadsheet’s SpreadsheetML XML reader. An attacker can craft an XML with an oversized ss:Index (e.g., 999999999) on a , inflating the internal cachedHighestRow to ~1 billion and causing CPU exhaustion during row iteration. This leads to denial of service when processing...