Phpspreadsheet
Monthly
PhpSpreadsheet's SpreadsheetML reader (Reader\Xml) can be induced to pass a DOCTYPE/ENTITY block into SimpleXML despite its entity-blocking scanner, because the scanner's html_entity_decode callback runs after the pattern check and the content is scanned twice. Files containing a double-encoded less-than character (&#60; or &#x3C;) smuggle a literal '<!DOCTYPE' past both passes, so processing attacker-controlled XML with the Xml reader yields entity-expansion denial of service on all PHP versions, plus local file read or SSRF where external entities are still resolved (PHP before 8.0, libxml2 before 2.9, or any PHP build with LIBXML_NOENT enabled). Affected releases are 3.3.0 through 3.10.7 and 4.0.0 through 5.9.0; vendor fixes are released as 3.10.8 and 5.10.0. No CISA KEV listing or confirmed active exploitation is reported, but the vendor advisory itself publishes a proof-of-concept that was reportedly exercised against PhpSpreadsheet 5.9.0, and the priority signal places remediation in the this-week band rather than emergency.
Denial of service in the PhpSpreadsheet ODS reader allows unauthenticated remote attackers to exhaust a PHP worker's CPU and memory by loading a small crafted .ods file, terminating the process. Every maintained branch is affected - 1.x up to and including 1.30.6, 2.0-2.1 up to 2.1.18, 2.2-2.4 up to 2.4.7, 3.x up to 3.10.7 and 4.x-5.x up to 5.9.0 - whenever an application parses an attacker-supplied OpenDocument Spreadsheet using the default read filter, since no authentication or special configuration is required. A public proof-of-concept payload is documented in the vendor advisory; it is not verified as working exploit code, and no confirmed active exploitation (CISA KEV) is recorded at time of analysis.
PhpSpreadsheet's XLSX reader can be tricked into parsing attacker-supplied DOCTYPE and entity declarations, because the XML security scanner in XmlScanner::scan() only anticipates NUL-byte interleaving and is defeated by ISO-2022 escape sequences inserted into the declaration. Any application that accepts user-uploaded spreadsheets and processes them with the Xlsx reader is affected, and the prerequisite is only that the file be opened; the CVSS vector shows PR:N/UI:N, so no authentication or interaction beyond the file upload is needed. The reliably exploitable outcome is entity-expansion denial of service on all supported PHP versions (a ~2 KB XLSX produced ~45 MB peak memory in the advisory's testing, roughly a 22,000:1 amplification); local file read and SSRF through external SYSTEM entities are conditional on PHP < 8.0 / libxml2 < 2.9 or on the application explicitly passing LIBXML_NOENT. A public proof-of-concept is published in the GitHub security advisory at https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-3x94-m842-937c; there is no CISA KEV confirmation of active exploitation, and the priority decision is to patch this week.
Blind server-side request forgery in PhpSpreadsheet allows an attacker-supplied spreadsheet (or HTML document) to steer the reading server's outbound image fetch to an internal address, because the operator's isWhitelisted callback is checked only against the initial external-image URL and never against HTTP redirect hops. Only deployments that have explicitly called setAllowExternalImages(true) - the default in BaseReader is false - and that also configure a whitelist which permits the attacker's redirecting host are exposed; those prerequisites make this a non-default configuration issue rather than a universal one. Impact is bounded: the fetched body is validated with isImage() and the temporary file is deleted, so the response is not returned to the attacker and the primitive is limited to triggering blind GET requests, coarse internal reachability probing and reaching endpoints such as cloud metadata services. A public PoC reference describing the redirect chain exists; it is not verified as working exploit code, and there is no confirmed active exploitation (CISA KEV).
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
This affects the package phpoffice/phpspreadsheet from 0.0.0. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PhpSpreadsheet's SpreadsheetML reader (Reader\Xml) can be induced to pass a DOCTYPE/ENTITY block into SimpleXML despite its entity-blocking scanner, because the scanner's html_entity_decode callback runs after the pattern check and the content is scanned twice. Files containing a double-encoded less-than character (&#60; or &#x3C;) smuggle a literal '<!DOCTYPE' past both passes, so processing attacker-controlled XML with the Xml reader yields entity-expansion denial of service on all PHP versions, plus local file read or SSRF where external entities are still resolved (PHP before 8.0, libxml2 before 2.9, or any PHP build with LIBXML_NOENT enabled). Affected releases are 3.3.0 through 3.10.7 and 4.0.0 through 5.9.0; vendor fixes are released as 3.10.8 and 5.10.0. No CISA KEV listing or confirmed active exploitation is reported, but the vendor advisory itself publishes a proof-of-concept that was reportedly exercised against PhpSpreadsheet 5.9.0, and the priority signal places remediation in the this-week band rather than emergency.
Denial of service in the PhpSpreadsheet ODS reader allows unauthenticated remote attackers to exhaust a PHP worker's CPU and memory by loading a small crafted .ods file, terminating the process. Every maintained branch is affected - 1.x up to and including 1.30.6, 2.0-2.1 up to 2.1.18, 2.2-2.4 up to 2.4.7, 3.x up to 3.10.7 and 4.x-5.x up to 5.9.0 - whenever an application parses an attacker-supplied OpenDocument Spreadsheet using the default read filter, since no authentication or special configuration is required. A public proof-of-concept payload is documented in the vendor advisory; it is not verified as working exploit code, and no confirmed active exploitation (CISA KEV) is recorded at time of analysis.
PhpSpreadsheet's XLSX reader can be tricked into parsing attacker-supplied DOCTYPE and entity declarations, because the XML security scanner in XmlScanner::scan() only anticipates NUL-byte interleaving and is defeated by ISO-2022 escape sequences inserted into the declaration. Any application that accepts user-uploaded spreadsheets and processes them with the Xlsx reader is affected, and the prerequisite is only that the file be opened; the CVSS vector shows PR:N/UI:N, so no authentication or interaction beyond the file upload is needed. The reliably exploitable outcome is entity-expansion denial of service on all supported PHP versions (a ~2 KB XLSX produced ~45 MB peak memory in the advisory's testing, roughly a 22,000:1 amplification); local file read and SSRF through external SYSTEM entities are conditional on PHP < 8.0 / libxml2 < 2.9 or on the application explicitly passing LIBXML_NOENT. A public proof-of-concept is published in the GitHub security advisory at https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-3x94-m842-937c; there is no CISA KEV confirmation of active exploitation, and the priority decision is to patch this week.
Blind server-side request forgery in PhpSpreadsheet allows an attacker-supplied spreadsheet (or HTML document) to steer the reading server's outbound image fetch to an internal address, because the operator's isWhitelisted callback is checked only against the initial external-image URL and never against HTTP redirect hops. Only deployments that have explicitly called setAllowExternalImages(true) - the default in BaseReader is false - and that also configure a whitelist which permits the attacker's redirecting host are exposed; those prerequisites make this a non-default configuration issue rather than a universal one. Impact is bounded: the fetched body is validated with isImage() and the temporary file is deleted, so the response is not returned to the attacker and the primitive is limited to triggering blind GET requests, coarse internal reachability probing and reaching endpoints such as cloud metadata services. A public PoC reference describing the redirect chain exists; it is not verified as working exploit code, and there is no confirmed active exploitation (CISA KEV).
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
This affects the package phpoffice/phpspreadsheet from 0.0.0. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.