phpoffice/phpspreadsheet Security Advisories for 1.25.2 (7)
-
[HIGH] XXE in PHPSpreadsheet's XLSX reader
PKSA-mkg2-1wyw-57y7 CVE-2024-45293 GHSA-6hwr-6v2f-3m88
Affected version: >=2.0.0,<2.1.1|<1.29.1|>=2.2.0,<2.3.0
Reported by:
GitHub -
[MEDIUM] PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks
PKSA-p1pj-q951-6f1x CVE-2024-45292 GHSA-r8w8-74ww-j4wh
Affected version: >=2.0.0,<2.1.1|<1.29.2|>=2.2.0,<2.3.0
Reported by:
GitHub -
[MEDIUM] PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled
PKSA-7f9v-sb8k-krfb CVE-2024-45291 GHSA-w9xv-qf98-ccq4
Affected version: >=2.0.0,<2.1.1|<1.29.2|>=2.2.0,<2.3.0
Reported by:
GitHub -
[HIGH] PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery when opening XLSX file
PKSA-xk3k-rd1m-pxmg CVE-2024-45290 GHSA-5gpr-w2p5-6m37
Affected version: >=2.0.0,<2.1.1|<1.29.2|>=2.2.0,<2.3.0
Reported by:
GitHub -
[MEDIUM] PhpSpreadsheet has an Unauthenticated Cross-Site-Scripting (XSS) in sample file
PKSA-dvbq-8ft2-ngrw CVE-2024-45060 GHSA-v66g-p9x6-v98p
Affected version: >=2.0.0,<2.1.1|<1.29.2|>=2.2.0,<2.3.0
Reported by:
GitHub -
[HIGH] XXE in PHPSpreadsheet encoding is returned
PKSA-xp7t-fbrb-qjv4 CVE-2024-45048 GHSA-ghg6-32f9-2jp7
Affected version: >=2.0.0,<2.1.1|>=2.2.0,<2.2.1|<1.29.1
Reported by:
GitHub -
[MEDIUM] PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information
PKSA-m4hk-rk8p-4t5p CVE-2024-45046 GHSA-wgmf-q9vr-vww6
Affected version: <1.29.1|>=2.0.0,<2.1.0
Reported by:
GitHub