Phpoffice Phpexcel vulnerabilities

CVE-2020-7776 [MEDIUM] CWE-79 Cross-site scripting in phpoffice/phpspreadsheet Cross-site scripting in phpoffice/phpspreadsheet This affects the package phpoffice/phpspreadsheet. The library is vulnerable to XSS when creating an html output from an excel file by adding a comment on any cell. The root cause of this issue is within the HTML writer where user comments are concatenated as part of link and this is returned as HTML.

CVE-2018-19277 [HIGH] CWE-91 XXE in PHPSpreadsheet due to encoding issue XXE in PHPSpreadsheet due to encoding issue securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file

CVE-2019-12331 [HIGH] CWE-611 XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared in the header. This was a security measurement to prevent CVE-2018-19277 but the fix is not sufficient. By double-encoding the the xml payload to utf-7 it is possible