TI-2024-30363 Aliases CVE-2024-45291 GHSA-w9xv-qf98-ccq4

Path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled in PHPSpreadsheet

HIGH 71CWE-36Published 2024-10-07 · Updated 2024-10-08

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file that links images from arbitrary paths. When embedding images has been enabled in HTML writer with `$writer->setEmbedImages(true);` those files will be included in the output as `data:` URLs, regardless of the file's type. Also URLs can be used for embedding, resulting in a Server-Side Request Forgery vulnerability. When embedding images has been enabled, an attacker can read arbitrary files on the server and perform arbitrary HTTP GET requests. Note that any PHP protocol wrappers can be used, meaning that if for example the `expect://` wrapper is enabled, also remote code execution is possible. This issue has been addressed in release versions 1.29.2, 2.1.1, and 2.3.0. All users are advised to upgrade. there are no known workarounds for this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00864 58th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed PhpSpreadsheet (PHPOffice): 1.29.2, 2.1.1, 2.3.0phpoffice/phpspreadsheet (Packagist): 2.3.0, 1.29.2, 2.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
PHPOffice	PhpSpreadsheet	before 1.29.2; 2.0.0 to before 2.1.1; 2.2.0 to before 2.3.0	1.29.2, 2.1.1, 2.3.0	Patch available	CNA
—	phpoffice/phpspreadsheet (Packagist)	2.2.0 to before 2.3.0	2.3.0	Patch available	GHSA-w9xv-qf98-ccq4
—	phpoffice/phpspreadsheet (Packagist)	before 1.29.2	1.29.2	Patch available	GHSA-w9xv-qf98-ccq4
—	phpoffice/phpspreadsheet (Packagist)	2.0.0 to before 2.1.1	2.1.1	Patch available	GHSA-w9xv-qf98-ccq4
—	phpoffice/phpexcel (Packagist)	up to 1.8.2	—	No fix listed	GHSA-w9xv-qf98-ccq4

PhpSpreadsheet VendorPHPOffice Affected before 1.29.2; 2.0.0 to before 2.1.1; 2.2.0 to before 2.3.0 Fixed in 1.29.2, 2.1.1, 2.3.0 Patch available CNA
phpoffice/phpspreadsheet (Packagist) Vendor— Affected 2.2.0 to before 2.3.0 Fixed in 2.3.0 Patch available GHSA-w9xv-qf98-ccq4
phpoffice/phpspreadsheet (Packagist) Vendor— Affected before 1.29.2 Fixed in 1.29.2 Patch available GHSA-w9xv-qf98-ccq4
phpoffice/phpspreadsheet (Packagist) Vendor— Affected 2.0.0 to before 2.1.1 Fixed in 2.1.1 Patch available GHSA-w9xv-qf98-ccq4
phpoffice/phpexcel (Packagist) Vendor— Affected up to 1.8.2 Fixed in — No fix listed GHSA-w9xv-qf98-ccq4

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:phpoffice:phpspreadsheet::::::::	before 1.29.2; 2.0.0 to before 2.1.1; 2.2.0 to before 2.3.0	Vulnerable	PHPOffice

cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:* Versions before 1.29.2; 2.0.0 to before 2.1.1; 2.2.0 to before 2.3.0 Vulnerable ·PHPOffice

Remediation

Fix · CNA PhpSpreadsheet (PHPOffice) Fixed in 1.29.2, 2.1.1, 2.3.0
Fix · GHSA-w9xv-qf98-ccq4 phpoffice/phpspreadsheet (Packagist) Fixed in 2.3.0 Advisory →
Fix · GHSA-w9xv-qf98-ccq4 phpoffice/phpspreadsheet (Packagist) Fixed in 1.29.2 Advisory →
Fix · GHSA-w9xv-qf98-ccq4 phpoffice/phpspreadsheet (Packagist) Fixed in 2.1.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-45291
2026-10-03 Alias added: GHSA-w9xv-qf98-ccq4

References

Exploit 1

https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-w9xv-qf98-ccq4

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-45291

Other 4

TI-2026-26406 PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load CVSS 4.0CRITICAL 9.2
TI-2024-37339 PhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php file CVSS 4.0HIGH 8.3
TI-2024-37338 PhpSpreadsheet allows unauthorized reflected XSS in `Convert-Online.php` file CVSS 4.0HIGH 8.3
TI-2024-37325 PhpSpreadsheet vulnerable to unauthorized reflected XSS in the Accounting.php file CVSS 4.0HIGH 8.3
TI-2024-37324 PhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader class CVSS 4.0HIGH 8.3
TI-2024-30160 XML External Entity Reference (XXE) in PHPSpreadsheet CVSS 3.1HIGH 8.8

See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences