What is the CVSS score of CVE-2026-40296?

CVE-2026-40296 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-40296?

Yes, a patch is available for CVE-2026-40296. Update the affected software to the latest version immediately.

PhpSpreadsheet CVE-2026-40296

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-28 https://github.com/PHPOffice/PhpSpreadsheet

GHSA-hrmw-qprp-wgmc

PHP XSS

5.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network delivery via file upload, low complexity bypass, low-privilege file submitter, victim interaction required, scope changes to browser; confidentiality and integrity limited to session-class XSS impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 02:39 vuln.today

Analysis Generated

Jul 24, 2026 - 02:39 vuln.today

CVE Published

Apr 28, 2026 - 22:57 nvd

MEDIUM 5.4

DescriptionGitHub Advisory

It was discovered that there is a way to bypass HTML escaping in the HTML writer using custom number format codes.

The Problem

In Writer/Html.php around line 1592, the code checks if the formatted cell data equals the original data to decide whether to apply htmlspecialchars():

php

if ($cellData === $origData) {
    $cellData = htmlspecialchars($cellData, ...);
}

When a cell has a custom number format containing @ (text placeholder) with any additional literal characters, the formatter replaces @ with the cell value and adds the extra characters. This makes $cellData !== $origData, so htmlspecialchars() is skipped entirely.

Even a single trailing space in the format (@ ) is enough to bypass the escape.

Proof of Concept

php

use PhpOffice\PhpSpreadsheet\Spreadsheet;
use PhpOffice\PhpSpreadsheet\Writer\Html;
use PhpOffice\PhpSpreadsheet\Cell\DataType;

$spreadsheet = new Spreadsheet();
$sheet = $spreadsheet->getActiveSheet();

// XSS payload with malicious number format
$sheet->setCellValueExplicit('A1', '<img src=x onerror=alert(document.cookie)>', DataType::TYPE_STRING);
$sheet->getStyle('A1')->getNumberFormat()->setFormatCode('. @');

$writer = new Html($spreadsheet);
$writer->save('output.html');

The generated HTML contains:

html

<td>. <img src=x onerror=alert(document.cookie)></td>

The XSS payload is completely unescaped.

Tested Bypass Formats

Format Code	Result	Escaped?
`General` (default)	Original value	YES (safe)
`. @`	`.` + value	NO (XSS!)
`@` (trailing space)	value +	NO (XSS!)
`x@`	`x` + value	NO (XSS!)

This was tested with PhpSpreadsheet 4.5.0 and confirmed the XSS executes in the browser.

Impact

Any application that:

Accepts uploaded XLSX files from users
Converts them to HTML using PhpSpreadsheet's HTML writer
Displays the HTML to other users

...is vulnerable to stored XSS. The attacker embeds the payload in a cell value and sets a custom number format in the XLSX file's xl/styles.xml.

Suggested Fix

Always apply htmlspecialchars() regardless of whether formatting changed the value:

php

// Instead of conditional escaping:
$cellData = htmlspecialchars($cellData, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');

Or escape AFTER formatting, not conditionally based on equality.

Reporter

Keyvan Hardani

AnalysisAI

Stored XSS in PhpSpreadsheet's HTML writer (Writer/Html.php) allows an attacker who can supply a crafted XLSX file to inject arbitrary HTML into rendered output, executing JavaScript in victims' browsers. The root cause is a faulty identity-check gate at line ~1592 that skips htmlspecialchars() whenever a custom number format transforms cell data - a condition trivially triggered by adding any literal character (even a trailing space) to a format code containing the @ text placeholder. A detailed proof-of-concept is publicly available in the GitHub Security Advisory; the vulnerability is confirmed in PhpSpreadsheet versions across the 2.x, 3.x, and 4.x/5.x release lines, with patches released in 2.1.16, 2.4.5, 3.10.5, and 5.7.0. No active exploitation has been confirmed (not in CISA KEV), and the 0.03% EPSS score reflects low opportunistic exploitation probability at this time.

Technical ContextAI

PhpSpreadsheet (composer package phpoffice/phpspreadsheet) is the dominant PHP library for reading and writing spreadsheet files. Its HTML writer renders spreadsheet cells as HTML table cells. The vulnerability resides in Writer/Html.php, where the logic compares $cellData (after number formatting is applied) to $origData (the raw cell value) to decide whether to HTML-encode the output. When a cell's NumberFormat uses the @ text placeholder combined with any additional literal characters - such as '. @', '@ ', or 'x@' - the number formatter substitutes @ with the cell value and appends/prepends the literals, making $cellData !== $origData. This inequality causes the htmlspecialchars() call to be bypassed entirely. An attacker controls both the cell value (the XSS payload) and the format code (set in xl/styles.xml within the XLSX ZIP archive), making the bypass fully under their control. CWE-79 (Improper Neutralization of Input During Web Page Generation) precisely describes the root cause: HTML output is assembled from user-controlled input without guaranteed encoding.

RemediationAI

Upgrade to the vendor-patched release corresponding to your installed branch: 5.7.0 (for 4.0.0-5.6.0 installs), 3.10.5 (for 3.3.0-3.10.4), 2.4.5 (for 2.2.0-2.4.4), or 2.1.16 (for 2.0.0-2.1.15). All four fixes are confirmed in the GitHub advisory at https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-hrmw-qprp-wgmc. Update via Composer: composer update phpoffice/phpspreadsheet. If an immediate upgrade is not possible, the most effective compensating control is to strip or whitelist number format codes from untrusted XLSX files before passing them to the HTML writer - reject or sanitize any format code containing @ combined with additional literal characters. Alternatively, disable the HTML writer output pathway for untrusted uploads entirely and render spreadsheet data through a different, non-HTML mechanism until patched. Note that sanitizing cell values without also sanitizing format codes is insufficient, because the format code itself controls whether encoding is skipped.