PHPOffice Phpspreadsheet any version

PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load

securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file

PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared in the header. This was a security measurement to prevent CVE-2018-19277 but the fix is not sufficient. By double-encoding the the xml payload to utf-7 it is possible to bypass the check for the string ‚<!ENTITY‘ and thus allowing for an xml external entity processing (XXE) attack.

Path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled in PHPSpreadsheet

XML External Entity Reference (XXE) in PHPSpreadsheet

PhpSpreadsheet allows unauthorized reflected XSS in `Convert-Online.php` file

PhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php file

PhpSpreadsheet vulnerable to unauthorized reflected XSS in the Accounting.php file

PhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader class

Path traversal and Server-Side Request Forgery when opening XLSX files in PHPSpreadsheet

XML External Entity Reference (XXE) in PHPSpreadsheet's XLSX reader

PhpSpreadsheet XmlScanner bypass leads to XXE

XXE in PHPSpreadsheet's XLSX reader

PhpSpreadsheet: CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader

PhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions

Cross-site Scripting (XSS)

Unauthenticated Cross-Site-Scripting (XSS) in sample file in PHPSpreadsheet

Cross-Site Scripting (XSS) vulnerability in generateNavigation() function

PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information

PhpSpreadsheet vulnerable to bypass of the XSS sanitizer using the javascript protocol and special characters

PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header

PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks

PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability in custom properties

PhpSpreadsheet vulnerable to XSS in HTML writer via custom number format codes

PhpSpreadsheet XSS via number format text substitution in HTML Writer