CVE-2025-23210
published 2025-02-03CVE-2025-23210: phpoffice/phpspreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions have been found to have a Bypass of the Cross-site…
PriorityP423medium4.8CVSS 4.0
AVNACLATNPRLUIAVCLVILVANSCLSILSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.39%
30.5th percentile
phpoffice/phpspreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions have been found to have a Bypass of the Cross-site Scripting (XSS) sanitizer using the javascript protocol and special characters. This issue has been addressed in versions 3.9.0, 2.3.7, 2.1.8, and 1.29.9. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| phpoffice | phpexcel | 0 – 1.8.2 | — |
| phpoffice | phpspreadsheet | < 1.29.9 | 1.29.9 |
| phpoffice | phpspreadsheet | — | — |
| phpoffice | phpspreadsheet | — | — |
| phpoffice | phpspreadsheet | — | — |
| phpoffice | phpspreadsheet | >= 0 < 1.29.9 | 1.29.9 |
| phpoffice | phpspreadsheet | >= 2.0.0 < 2.1.8 | 2.1.8 |
| phpoffice | phpspreadsheet | >= 2.2.0 < 2.3.7 | 2.3.7 |
| phpoffice | phpspreadsheet | >= 3.0.0 < 3.9.0 | 3.9.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters
osv·2025-02-03
CVE-2025-23210 [MEDIUM] PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters
PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters
**Product:** PhpSpreadsheet
**Version:** 3.8.0
**CWE-ID:** CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
**CVSS vector v.3.1:** 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
**CVSS vector v.4.0:** 4.8 (AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N)
**Description:** an attacker can use special characters, so that the library processes the javascript protocol with special characters and generates an HTML link
**Impact:** executing arbitrary JavaScript code in the browser
**Vulnerable component:** class `PhpOffice\PhpSpreadsheet\Writer\Html`, method `generateRow`
**Exploitation conditions:** a user viewing a specially generated xml file
**M
GHSA
PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters
ghsa·2025-02-03
CVE-2025-23210 [MEDIUM] CWE-79 PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters
PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters
**Product:** PhpSpreadsheet
**Version:** 3.8.0
**CWE-ID:** CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
**CVSS vector v.3.1:** 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
**CVSS vector v.4.0:** 4.8 (AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N)
**Description:** an attacker can use special characters, so that the library processes the javascript protocol with special characters and generates an HTML link
**Impact:** executing arbitrary JavaScript code in the browser
**Vulnerable component:** class `PhpOffice\PhpSpreadsheet\Writer\Html`, method `generateRow`
**Exploitation conditions:** a user viewing a specially generated xml file
**M
No detection rules found.
No public exploits indexed.
2025-02-03
Published