CVE-2024-45048
XML External Entity Reference (XXE) in PHPSpreadsheet
- State
- Published
- Severity
- 8.8 High
- Published
- Aug 28, 2024
- Updated
- Aug 29, 2024
- Reserved
- Aug 21, 2024
Description
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions are subject to a bypassing of a filter which allows for an XXE-attack. This in turn allows attacker to obtain contents of local files, even if error reporting is muted. This vulnerability has been addressed in release version 2.2.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | GitHub_M |
Weaknesses
- CWE-611 Improper Restriction of XML External Entity Reference
Affected Products
| Product | Versions |
|---|---|
PhpSpreadsheetPHPOffice |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.