phpoffice/phpexcel vulnerabilities
PHPExcel - OpenXML - Read, Create and Write Spreadsheet documents in PHP - Spreadsheet engine
- Registry
- Composer
- Latest
- 1.8.2
- License
- LGPL-2.1
23 known advisories
The latest version, 1.8.2, is affected by 20 of them.
Security advisories for phpoffice/phpexcel
PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters
- Affected
- <=1.8.2
- Fixed in
- No fix released
Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet
- Affected
- <=1.8.2
- Fixed in
- No fix released
PhpSpreadsheet allows bypass XSS sanitizer using the javascript protocol and special characters
- Affected
- <=1.8.2
- Fixed in
- No fix released
PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header
- Affected
- <=1.8.2
- Fixed in
- No fix released
PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability in custom properties
- Affected
- <=1.8.2
- Fixed in
- No fix released
PhpSpreadsheet allows unauthorized Reflected XSS in Currency.php file
- Affected
- <=1.8.2
- Fixed in
- No fix released
PhpSpreadsheet allows unauthorized Reflected XSS in the Accounting.php file
- Affected
- <=1.8.2
- Fixed in
- No fix released
PhpSpreadsheet allows unauthorized Reflected XSS in the constructor of the Downloader class
- Affected
- <=1.8.2
- Fixed in
- No fix released
PhpSpreadsheet allows unauthorized Reflected XSS in `Convert-Online.php` file
- Affected
- <=1.8.2
- Fixed in
- No fix released
XXE in PHPSpreadsheet's XLSX reader
- Affected
- <=1.8.2
- Fixed in
- No fix released
XmlScanner bypass leads to XXE
- Affected
- <=1.8.2
- Fixed in
- No fix released
PHPExcel XXE Vulnerability
- Affected
- <1.8.1
- Fixed in
- 1.8.1
XXE in PHPSpreadsheet's XLSX reader
- Affected
- <=1.8.2
- Fixed in
- No fix released
PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks
- Affected
- <=1.8.2
- Fixed in
- No fix released
PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled
- Affected
- <=1.8.2
- Fixed in
- No fix released
PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery when opening XLSX file
- Affected
- <=1.8.2
- Fixed in
- No fix released
PhpSpreadsheet has an Unauthenticated Cross-Site-Scripting (XSS) in sample file
- Affected
- <=1.8.2
- Fixed in
- No fix released
XXE in PHPSpreadsheet encoding is returned
- Affected
- <=1.8.2
- Fixed in
- No fix released
PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information
- Affected
- <=1.8.2
- Fixed in
- No fix released
PHPExcel vulnerable to XXE attacks through libxml
- Affected
- <1.8.0
- Fixed in
- 1.8.0
Cross-site scripting in phpoffice/phpspreadsheet
- Affected
- <=1.8.2
- Fixed in
- No fix released
XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue
- Affected
- <=1.8.2
- Fixed in
- No fix released
XXE in PHPSpreadsheet due to encoding issue
- Affected
- <1.8.2
- Fixed in
- 1.8.2
Which of your client projects still run an old phpoffice/phpexcel?
NPMscan reads the composer.lock in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other Composer packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the Composer registry.