TI-2024-32614 Aliases CVE-2024-48917 GHSA-7cc9-j4mv-vcjp

XXE in PHPSpreadsheet's XLSX reader

MEDIUM 40CWE-611Published 2024-11-18 · Updated 2024-11-18

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-611 and the CVSS impact.

Summary

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. The `XmlScanner` class has a scan method which should prevent XXE attacks. However, in a bypass of the previously reported `CVE-2024-47873`, the regexes from the `findCharSet` method, which is used for determining the current encoding can be bypassed by using a payload in the encoding UTF-7, and adding at end of the file a comment with the value `encoding="UTF-8"` with `"`, which is matched by the first regex, so that `encoding='UTF-7'` with single quotes `'` in the XML header is not matched by the second regex. An attacker can bypass the sanitizer and achieve an XML external entity attack. Versions 1.9.4, 2.1.3, 2.3.2, and 3.4.0 fix the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00728 54th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed PhpSpreadsheet (PHPOffice): 1.29.4, 2.1.3, 2.3.2 +1phpoffice/phpspreadsheet (Packagist): 1.29.4, 2.1.3, 2.3.2 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
PHPOffice	PhpSpreadsheet	before 1.29.4; 2.0.0 to before 2.1.3; 2.2.0 to before 2.3.2; 3.3.0 to before 3.4.0	1.29.4, 2.1.3, 2.3.2, 3.4.0	Patch available	CNA
—	phpoffice/phpspreadsheet (Packagist)	before 1.29.4	1.29.4	Patch available	GHSA-7cc9-j4mv-vcjp
—	phpoffice/phpspreadsheet (Packagist)	2.0.0 to before 2.1.3	2.1.3	Patch available	GHSA-7cc9-j4mv-vcjp
—	phpoffice/phpspreadsheet (Packagist)	2.2.0 to before 2.3.2	2.3.2	Patch available	GHSA-7cc9-j4mv-vcjp
—	phpoffice/phpspreadsheet (Packagist)	3.3.0 to before 3.4.0	3.4.0	Patch available	GHSA-7cc9-j4mv-vcjp
—	phpoffice/phpexcel (Packagist)	up to 1.8.2	—	No fix listed	GHSA-7cc9-j4mv-vcjp

PhpSpreadsheet VendorPHPOffice Affected before 1.29.4; 2.0.0 to before 2.1.3; 2.2.0 to before 2.3.2; 3.3.0 to before 3.4.0 Fixed in 1.29.4, 2.1.3, 2.3.2, 3.4.0 Patch available CNA
phpoffice/phpspreadsheet (Packagist) Vendor— Affected before 1.29.4 Fixed in 1.29.4 Patch available GHSA-7cc9-j4mv-vcjp
phpoffice/phpspreadsheet (Packagist) Vendor— Affected 2.0.0 to before 2.1.3 Fixed in 2.1.3 Patch available GHSA-7cc9-j4mv-vcjp
phpoffice/phpspreadsheet (Packagist) Vendor— Affected 2.2.0 to before 2.3.2 Fixed in 2.3.2 Patch available GHSA-7cc9-j4mv-vcjp
phpoffice/phpspreadsheet (Packagist) Vendor— Affected 3.3.0 to before 3.4.0 Fixed in 3.4.0 Patch available GHSA-7cc9-j4mv-vcjp
phpoffice/phpexcel (Packagist) Vendor— Affected up to 1.8.2 Fixed in — No fix listed GHSA-7cc9-j4mv-vcjp

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:phpoffice:phpspreadsheet::::::::	before 1.29.4; 2.0.0 to before 2.1.3; 2.2.0 to before 2.3.2; 3.3.0 to before 3.4.0	Vulnerable	PHPOffice

cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:* Versions before 1.29.4; 2.0.0 to before 2.1.3; 2.2.0 to before 2.3.2; 3.3.0 to before 3.4.0 Vulnerable ·PHPOffice

Remediation

Fix · CNA PhpSpreadsheet (PHPOffice) Fixed in 1.29.4, 2.1.3, 2.3.2, 3.4.0
Fix · GHSA-7cc9-j4mv-vcjp phpoffice/phpspreadsheet (Packagist) Fixed in 1.29.4 Advisory →
Fix · GHSA-7cc9-j4mv-vcjp phpoffice/phpspreadsheet (Packagist) Fixed in 2.1.3 Advisory →
Fix · GHSA-7cc9-j4mv-vcjp phpoffice/phpspreadsheet (Packagist) Fixed in 2.3.2 Advisory →
Fix · GHSA-7cc9-j4mv-vcjp phpoffice/phpspreadsheet (Packagist) Fixed in 3.4.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-48917
2026-10-03 Alias added: GHSA-7cc9-j4mv-vcjp

References

Exploit 1

https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-7cc9-j4mv-vcjp

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-48917

Other 3

TI-2026-26406 PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load CVSS 4.0CRITICAL 9.2
TI-2024-37339 PhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php file CVSS 4.0HIGH 8.3
TI-2024-37338 PhpSpreadsheet allows unauthorized reflected XSS in `Convert-Online.php` file CVSS 4.0HIGH 8.3
TI-2024-37325 PhpSpreadsheet vulnerable to unauthorized reflected XSS in the Accounting.php file CVSS 4.0HIGH 8.3
TI-2024-37324 PhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader class CVSS 4.0HIGH 8.3
TI-2024-30160 XML External Entity Reference (XXE) in PHPSpreadsheet CVSS 3.1HIGH 8.8

See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences