CVE-2024-56412
Severity CVSS v4.0:
MEDIUM
Type:
CWE-79
Cross-Site Scripting (XSS)
Publication date:
03/01/2025
Last modified:
06/03/2025
Description
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to bypass of the cross-site scripting sanitizer using the javascript protocol and special characters. An attacker can use special characters, so that the library processes the javascript protocol with special characters and generates an HTML link. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.
Impact
Base Score 4.0
4.80
Severity 4.0
MEDIUM
Base Score 3.x
5.40
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:* | 1.29.7 (excluding) | |
| cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:* | 2.0.0 (including) | 2.1.6 (excluding) |
| cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:* | 2.2.0 (including) | 2.3.5 (excluding) |
| cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:* | 3.0.0 (including) | 3.7.0 (excluding) |
To consult the complete list of CPE names with products and versions, see this page