securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection…
Priority MEDIUM 49CWE-91Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file
Why it matters now
EPSS 0.07791 94th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed phpoffice/phpspreadsheet (Packagist): 1.5.1phpoffice/phpexcel (Packagist): 1.8.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | phpoffice/phpspreadsheet (Packagist) | before 1.5.1 | 1.5.1 | Patch available | GHSA-xcrg-29h7-h4cj |
| — | phpoffice/phpexcel (Packagist) | before 1.8.2 | 1.8.2 | Patch available | GHSA-xcrg-29h7-h4cj |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- phpoffice/phpspreadsheet (Packagist) Vendor— Affected before 1.5.1 Fixed in 1.5.1 Patch available GHSA-xcrg-29h7-h4cj
- phpoffice/phpexcel (Packagist) Vendor— Affected before 1.8.2 Fixed in 1.8.2 Patch available GHSA-xcrg-29h7-h4cj
Remediation
- Fix · GHSA-xcrg-29h7-h4cj phpoffice/phpspreadsheet (Packagist) Fixed in 1.5.1 Advisory →
- Fix · GHSA-xcrg-29h7-h4cj phpoffice/phpexcel (Packagist) Fixed in 1.8.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2018-19277
- 2026-10-03 Alias added: GHSA-xcrg-29h7-h4cj
References
Advisory 3
Other 9
- https://www.bishopfox.com/news/2018/11/phpoffice-versions/
- https://github.com/PHPOffice/PhpSpreadsheet/pull/780
- https://github.com/PHPOffice/PHPExcel/commit/2b601574975acfb9d4378a788ed5f2b747958095
- https://github.com/PHPOffice/PhpSpreadsheet/commit/0f8f071e24ee8b114d894ac172f77dc250e5bfa4
- https://github.com/FriendsOfPHP/security-advisories/blob/master/phpoffice/phpspreadsheet/CVE-2018-19277.yaml
- https://github.com/PHPOffice/PHPExcel/commits/1.8.2
- https://github.com/PHPOffice/PhpSpreadsheet
- https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.5.1
- https://www.bishopfox.com/news/2018/11/phpoffice-versions
More PHPOffice Phpspreadsheet vulnerabilities
- TI-2026-26406 PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load CVSS 4.0CRITICAL 9.2
- TI-2024-37339 PhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php file CVSS 4.0HIGH 8.3
- TI-2024-37338 PhpSpreadsheet allows unauthorized reflected XSS in `Convert-Online.php` file CVSS 4.0HIGH 8.3
- TI-2024-37325 PhpSpreadsheet vulnerable to unauthorized reflected XSS in the Accounting.php file CVSS 4.0HIGH 8.3
- TI-2024-37324 PhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader class CVSS 4.0HIGH 8.3
- TI-2024-30160 XML External Entity Reference (XXE) in PHPSpreadsheet CVSS 3.1HIGH 8.8
Sources
- CVE-2018-19277 · CVE Program
- CVE-2018-19277 · NVD
- FIRST EPSS
- GHSA-xcrg-29h7-h4cj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences