Phpoffice Phpspreadsheet vulnerabilities

CVE-2024-45060 [MEDIUM] CWE-79 CVE-2024-45060: PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. One of the sample sc PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. One of the sample scripts in PhpSpreadsheet is susceptible to a cross-site scripting (XSS) vulnerability due to improper handling of input where a number is expected leading to formula injection. The code in in `45_Quadratic_equation_solver.php` concatenates the user supp

CVE-2024-56366 [MEDIUM] CWE-79 CVE-2024-56366: PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the `Accounting.php` file. Using the `/vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Accounting.php` script, an attacker can perform a cross-site sc

CVE-2024-56409 [MEDIUM] CWE-79 CVE-2024-56409: PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the `Currency.php` file. Using the `/vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Currency.php` script, an attacker can perform a cross-site script

CVE-2026-40296 [MEDIUM] CWE-79 CVE-2026-40296: PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The HTML writer skip PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The HTML writer skips htmlspecialchars escaping when a cell's formatted value differs from the original value. When a cell has a custom number format containing the text placeholder @ along with any additional literal characters (for example ". @", "@ ", or "x@"), the for

CVE-2024-56412 [MEDIUM] CWE-79 CVE-2024-56412: PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to bypass of the cross-site scripting sanitizer using the javascript protocol and special characters. An attacker can use special characters, so that the library processes the javascript protocol with special char

CVE-2024-56410 [MEDIUM] CWE-79 CVE-2024-56410: PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have a cross-site scripting (XSS) vulnerability in custom properties. The HTML page is generated without clearing custom properties. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.

CVE-2024-56365 [MEDIUM] CWE-79 CVE-2024-56365: PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the constructor of the `Downloader` class. Using the `/vendor/phpoffice/phpspreadsheet/samples/download.php` script, an attacker can perform a cross-site scripting

CVE-2024-56411 [MEDIUM] CWE-79 CVE-2024-56411: PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have a cross-site scripting (XSS) vulnerability of the hyperlink base in the HTML page header. The HTML page is formed without sanitizing the hyperlink base. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue

CVE-2024-45292 [MEDIUM] CWE-79 CVE-2024-45292: PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. `\PhpOffice\PhpSprea PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. `\PhpOffice\PhpSpreadsheet\Writer\Html` does not sanitize "javascript:" URLs from hyperlink `href` attributes, resulting in a Cross-Site Scripting vulnerability. This issue has been addressed in release versions 1.29.2, 2.1.1, and 2.3.0. All users are advised to upgrade.

CVE-2025-22131 [MEDIUM] CWE-79 CVE-2025-22131: PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Cross-Site Scripting (XSS PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Cross-Site Scripting (XSS) vulnerability in the code which translates the XLSX file into a HTML representation and displays it in the response.

CVE-2025-23210 [MEDIUM] CWE-79 CVE-2025-23210: phpoffice/phpspreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected v phpoffice/phpspreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions have been found to have a Bypass of the Cross-site Scripting (XSS) sanitizer using the javascript protocol and special characters. This issue has been addressed in versions 3.9.0, 2.3.7, 2.1.8, and 1.29.9. Users are advised to upgrade. There ar