Sign in
Deutsch English Español Polski
High

XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue

  • Disclosed: 20.11.2019
  • Updated: 11.10.2026 10:22

PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared in the header. This was a security measurement to prevent CVE-2018-19277 but the fix is not sufficient. By double-encoding the the xml payload to utf-7 it is possible to bypass the check for the string ?<!ENTITY? and thus allowing for an xml external entity processing (XXE) attack.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package phpoffice/phpexcel <= 1.8.2 no fix
Composer package phpoffice/phpspreadsheet < 1.8.0 1.8.0

References

CVSS score 8.8/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness (CWE)
CWE-611
Platform
Composer
Package
phpoffice/phpexcel, phpoffice/phpspreadsheet
Disclosed
20.11.2019
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-vvwv-h69m-wg6f - CC BY 4.0

Vulnerability history: phpoffice/phpspreadsheet

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (31) in the archive
Total entries
31
First → latest
11.2019 07.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 2
  • High 17
  • Medium 12

Disclosures per year

Severity:
  1. PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
    High · 7.5 CVE-2026-59933 >= 4.0.0, < 5.8.1, >= 3.3.0, < 3.10.7, >= 2.2.0, < 2.4.7, >= 2.0.0, < 2.1.18, < 1.30.6 5.8.1, 3.10.7, 2.4.7, 2.1.18, 1.30.6
  2. PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
    High · 7.5 CVE-2026-59932 >= 4.0.0, < 5.8.1, >= 3.3.0, < 3.10.7, >= 2.2.0, < 2.4.7, >= 2.0.0, < 2.1.18, < 1.30.6 5.8.1, 3.10.7, 2.4.7, 2.1.18, 1.30.6
  3. PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
    High · 7.7 CVE-2026-59931 >= 4.0.0, < 5.8.1, >= 3.3.0, < 3.10.7, >= 2.2.0, < 2.4.7, >= 2.0.0, < 2.1.18, < 1.30.6 5.8.1, 3.10.7, 2.4.7, 2.1.18, 1.30.6
  4. PHPSpreadsheet has a patch bypass for CVE-2026-34084
    Critical CVE-2026-45034 < 1.30.5 1.30.5
  5. PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions
    High · 7.5 CVE-2026-40902 >= 4.0.0, < 5.7.0, >= 3.3.0, < 3.10.5, >= 2.2.0, < 2.4.5, >= 2.0.0, < 2.1.16, < 1.30.4 5.7.0, 3.10.5, 2.4.5, 2.1.16, 1.30.4
  6. PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader
    High · 7.5 CVE-2026-40863 >= 4.0.0, < 5.7.0, >= 3.3.0, < 3.10.5, >= 2.2.0, < 2.4.5, >= 2.0.0, < 2.1.16, < 1.30.4 5.7.0, 3.10.5, 2.4.5, 2.1.16, 1.30.4
  7. PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled
    Critical CVE-2026-34084 >= 4.0.0, < 5.6.0, >= 3.3.0, < 3.10.4, >= 2.2.0, < 2.4.4, >= 2.0.0, < 2.1.15, < 1.30.3 5.6.0, 3.10.4, 2.4.4, 2.1.15, 1.30.3
  8. PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser
    High CVE-2025-54370 < 1.30.0, >= 2.0.0, < 2.1.12, >= 2.2.0, < 2.4.0, >= 3.0.0, < 3.10.0, >= 4.0.0, < 5.0.0 1.30.0, 2.1.12, 2.4.0, 3.10.0, 5.0.0
  9. PhpSpreadsheet allows unauthorized Reflected XSS in Currency.php file
    High · 7.1 CVE-2024-56409 >= 3.0.0, < 3.7.0, < 1.29.7, >= 2.0.0, < 2.1.6, >= 2.2.0, < 2.3.5 3.7.0, 1.29.7, 2.1.6, 2.3.5
  10. PhpSpreadsheet allows unauthorized Reflected XSS in the Accounting.php file
    High · 7.1 CVE-2024-56366 >= 3.0.0, < 3.7.0, < 1.29.7, >= 2.0.0, < 2.1.6, >= 2.2.0, < 2.3.5 3.7.0, 1.29.7, 2.1.6, 2.3.5
  11. PhpSpreadsheet allows unauthorized Reflected XSS in the constructor of the Downloader class
    High · 7.1 CVE-2024-56365 >= 3.0.0, < 3.7.0, < 1.29.7, >= 2.0.0, < 2.1.6, >= 2.2.0, < 2.3.5 3.7.0, 1.29.7, 2.1.6, 2.3.5
  12. PhpSpreadsheet allows unauthorized Reflected XSS in `Convert-Online.php` file
    High · 7.1 CVE-2024-56408 >= 3.0.0, < 3.7.0, < 1.29.7, >= 2.0.0, < 2.1.6, >= 2.2.0, < 2.3.5 3.7.0, 1.29.7, 2.1.6, 2.3.5
  13. XXE in PHPSpreadsheet's XLSX reader
    High · 7.5 CVE-2024-48917 < 1.29.4, >= 2.0.0, < 2.1.3, >= 2.2.0, < 2.3.2, >= 3.3.0, < 3.4.0 1.29.4, 2.1.3, 2.3.2, 3.4.0
  14. XmlScanner bypass leads to XXE
    High · 7.5 CVE-2024-47873 < 1.29.4, >= 2.0.0, < 2.1.3, >= 2.2.0, < 2.3.2, >= 3.3.0, < 3.4.0 1.29.4, 2.1.3, 2.3.2, 3.4.0
  15. PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery when opening XLSX file
    High · 7.7 CVE-2024-45290 >= 2.2.0, < 2.3.0, < 1.29.2, >= 2.0.0, < 2.1.1 2.3.0, 1.29.2, 2.1.1
  16. PHPSpreadsheet Library < 2.3.0 - XXE Injection
    High · 7.5 CVE-2024-45293 >= 2.2.0, < 2.3.0, < 1.29.1, >= 2.0.0, < 2.1.1 2.3.0, 1.29.1, 2.1.1
  17. XXE in PHPSpreadsheet encoding is returned
    High · 8.8 CVE-2024-45048 < 1.29.1, >= 2.2.0, < 2.2.1, >= 2.0.0, < 2.1.1 1.29.1, 2.2.1, 2.1.1
  18. XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue this entry
    High · 8.8 CVE-2019-12331 < 1.8.0 1.8.0
  19. XXE in PHPSpreadsheet due to encoding issue
    High · 8.8 CVE-2018-19277 < 1.5.1 1.5.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.