CVE-2018-19277

CVE-2018-19277 affects PhpSpreadsheet (PHPOffice) up to version 1.5.0. The flaw: the library’s XML handling in Xlsx files can bypass protection via UTF-7 encoding, enabling an XML External Entity (XXE) attack. Root cause per sources: XmlScanner/Xml parsing when declared encoding differs from UTF-...

CVE-2024-45048

CVE-2024-45048 (PHPSpreadsheet) : A bypass of a filter in affected PHPSpreadsheet versions enables an XXE attack, allowing access to local file contents even when error reporting is muted. The vulnerability is fixed in release 2.2.1; all users should upgrade to that version. Impact is described a...

CVE-2019-12331

PHPOffice PhpSpreadsheet before 1.8.0 contains an XXE flaw in the XML handling of sheet1.xml. The XmlScanner decodes sheet1.xml to UTF-8 when a non-UTF-8 encoding is declared, and an attacker can double-encode payloads in UTF-7 to bypass the string check for , enabling XML External Entity (XXE) p...

CVE-2024-56408

PhpSpreadsheet (PHP) has a cross-site scripting (XSS) vulnerability in the Convert-Online.php sample due to missing input sanitization. Affected versions are prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7; these versions lack sanitization in /vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-...

CVE-2024-56365

PhpSpreadsheet (phpspreadsheet) has an unauthorized reflected XSS in the Downloader constructor. Affected versions pre-3.7.0, pre-2.3.5, pre-2.1.6, and pre-1.29.7 are vulnerable via GET parameters in the samples/download.php script. The issue allows executing arbitrary JavaScript in the victim’s ...

CVE-2024-56366

PhpSpreadsheet contains an unauthorized reflected XSS in Accounting.php via the currency parameter. Affected versions are prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7. The vulnerability can be triggered using the samples/Wizards/NumberFormat/Accounting.php script (PoC shown in the referenced material...

CVE-2024-56409

CVE-2024-56409 concerns PhpSpreadsheet, a PHP library for spreadsheet handling. The vulnerability affects the vulnerable component in the Currency.php sample, where the currency parameter is not sanitized, allowing an unauthorized reflected cross-site scripting (XSS) attack when an attacker submi...

CVE-2024-45291

PHPSpreadsheet (PHPSpreadsheet) contains a path traversal/SRV (Server-Side Request Forgery) vulnerability in the HTML writer when embedImages is enabled. An XLSX can link images from arbitrary paths; output data: URLs may include local files and, with wrappers like expect://, enable remote reques...