[HIGH] XXE in PHPSpreadsheet's XLSX reader

PKSA-gst3-cdk3-bpqt CVE-2024-48917 GHSA-7cc9-j4mv-vcjp

Affected version: >=3.3.0,<3.4.0|>=2.2.0,<2.3.2|>=2.0.0,<2.1.3|<1.29.4

Reported by:
GitHub

[HIGH] XmlScanner bypass leads to XXE

PKSA-dbrb-pvhs-h3st CVE-2024-47873 GHSA-jw4x-v69f-hh5w

Affected version: >=3.3.0,<3.4.0|>=2.2.0,<2.3.2|>=2.0.0,<2.1.3|<1.29.4

Reported by:
GitHub

[HIGH] XXE in PHPSpreadsheet's XLSX reader

PKSA-mkg2-1wyw-57y7 CVE-2024-45293 GHSA-6hwr-6v2f-3m88

Affected version: >=2.0.0,<2.1.1|<1.29.1|>=2.2.0,<2.3.0

Reported by:
GitHub

[MEDIUM] PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks

PKSA-p1pj-q951-6f1x CVE-2024-45292 GHSA-r8w8-74ww-j4wh

Affected version: >=2.0.0,<2.1.1|<1.29.2|>=2.2.0,<2.3.0

Reported by:
GitHub

[MEDIUM] PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled

PKSA-7f9v-sb8k-krfb CVE-2024-45291 GHSA-w9xv-qf98-ccq4

Affected version: >=2.0.0,<2.1.1|<1.29.2|>=2.2.0,<2.3.0

Reported by:
GitHub

[HIGH] PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery when opening XLSX file

PKSA-xk3k-rd1m-pxmg CVE-2024-45290 GHSA-5gpr-w2p5-6m37

Affected version: >=2.0.0,<2.1.1|<1.29.2|>=2.2.0,<2.3.0

Reported by:
GitHub

[MEDIUM] PhpSpreadsheet has an Unauthenticated Cross-Site-Scripting (XSS) in sample file

PKSA-dvbq-8ft2-ngrw CVE-2024-45060 GHSA-v66g-p9x6-v98p

Affected version: >=2.0.0,<2.1.1|<1.29.2|>=2.2.0,<2.3.0

Reported by:
GitHub

[HIGH] XXE in PHPSpreadsheet encoding is returned

PKSA-xp7t-fbrb-qjv4 CVE-2024-45048 GHSA-ghg6-32f9-2jp7

Affected version: >=2.0.0,<2.1.1|>=2.2.0,<2.2.1|<1.29.1

Reported by:
GitHub

[MEDIUM] PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information

PKSA-m4hk-rk8p-4t5p CVE-2024-45046 GHSA-wgmf-q9vr-vww6

Affected version: <1.29.1|>=2.0.0,<2.1.0

Reported by:
GitHub

[MEDIUM] XSS Vulnerability in HTML Writer

PKSA-xgcn-ywd7-3wqn CVE-2020-7776 GHSA-4mqv-gcr3-pff9

Affected version: <1.16.0

Reported by:
GitHub, FriendsOfPHP/security-advisories