HighGHSA-xcrg-29h7-h4cjCVE-2018-19277
XXE in PHPSpreadsheet due to encoding issue
Published 20 Nov 2019 · Updated 6 Mar 2025
Affected packages
phpoffice/phpspreadsheetComposer
- Affected
- <1.5.1
- Fixed in
- 1.5.1
Update to the fixed version for your release line, for example:
composer require phpoffice/phpspreadsheet:^1.5.1phpoffice/phpexcelComposer
- Affected
- <1.8.2
- Fixed in
- 1.8.2
Update to the fixed version for your release line, for example:
composer require phpoffice/phpexcel:^1.8.2Details
securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file
Is GHSA-xcrg-29h7-h4cj in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected phpoffice/phpspreadsheet, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2018-19277
- Linkgithub.com/MewesK/TwigSpreadsheetBundle/issues/18
- Linkgithub.com/PHPOffice/PhpSpreadsheet/issues/771
- Linkgithub.com/PHPOffice/PhpSpreadsheet/pull/780
- Linkgithub.com/PHPOffice/PHPExcel/commit/2b601574975acfb9d4378a788ed5f2b747958095
- Linkgithub.com/PHPOffice/PhpSpreadsheet/commit/0f8f071e24ee8b114d894ac172f77dc250e5bfa4
- Linkgithub.com/FriendsOfPHP/security-advisories/blob/master/phpoffice/phpspreadsheet/CVE-2018-19277.yaml
- Linkgithub.com/PHPOffice/PHPExcel/commits/1.8.2
- Packagegithub.com/PHPOffice/PhpSpreadsheet
- Linkgithub.com/PHPOffice/PhpSpreadsheet/releases/tag/1.5.1
- Linkwww.bishopfox.com/news/2018/11/phpoffice-versions
- Linkwww.drupal.org/sa-contrib-2021-043
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.