PHPOffice PhpSpreadsheet
Approved changes feed: RSS · Atom
cpe:2.3:a:phpoffice:phpspreadsheet:-:*:*:*:*:*:*:*
part: a version: - update: *
| Vendor | Phpoffice (e4c72832-34b4-50fe-866e-c2d34a3f9655) |
|---|---|
| Product | Phpspreadsheet (6b08b14a-6be3-544c-9fc7-1faf3b4df1af) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:composer/ecbc-phpoffice/phpspreadsheet |
purl2cpe | 2026-06-01 10:13:25.638283 |
pkg:github/phpoffice/phpspreadsheet |
purl2cpe | 2026-06-01 10:13:25.638285 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-48917 |
vulnerable | 2026-06-08 06:50:11.695497 |
XXE in PHPSpreadsheet's XLSX reader
HIGH (7.5)
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. The `XmlScanner` class has a scan method which should prevent XXE attacks. However, in a bypass of the previously reported `CVE-2024-47873`, the regexes from the `findCharSet` method, which is used for determining the current encoding can be bypassed by using a payload in the encoding UTF-7, and adding at end of the file a comment with the value `encoding="UTF-8"` with `"`, which is matched by the first regex, so that `encoding='UTF-7'` with single quotes `'` in the XML header is not matched by the second regex. An attacker can bypass the sanitizer and achieve an XML external entity attack. Versions 1.9.4, 2.1.3, 2.3.2, and 3.4.0 fix the issue.
Published: 2024-11-18T19:48:42.656Z
Updated: 2024-11-18T20:15:55.299Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.