PT-2024-10176 · Phpoffice · Phpspreadsheet

Aleksey Solovev · Published 2024-12-23 · Updated 2025-04-21 · CVE-2024-56366

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L

Name of the Vulnerable Software and Affected Versions PhpSpreadsheet versions prior to 3.7.0 PhpSpreadsheet versions prior to 2.3.5 PhpSpreadsheet versions prior to 2.1.6 PhpSpreadsheet versions prior to 1.29.7

Description The issue is related to unauthorized reflected cross-site scripting in the Accounting.php file. Using the /vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Accounting.php script, an attacker can perform a cross-site scripting attack. The vulnerability allows an attacker to execute arbitrary JavaScript code in the browser. The vulnerable component is the /vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Accounting.php file, and the exploitation conditions involve an unauthorized user.

Recommendations Update to version 3.7.0 or later to fix the issue. Update to version 2.3.5 or later to fix the issue. Update to version 2.1.6 or later to fix the issue. Update to version 1.29.7 or later to fix the issue. As a temporary workaround, consider sanitizing the currency variable in the Accounting.php file to prevent cross-site scripting attacks. Restrict access to the /vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Accounting.php script to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-00503

CVE-2024-56366

GHSA-C6FV-7VH8-2RHR

Affected Products

Phpspreadsheet

References · 15

• 🔥 https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-c6fv-7vh8-2rhr · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56366.json · Exploit
• https://github.com/PHPOffice/PhpSpreadsheet/commit/700a80346be269af668914172bc6f4521982d0b4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-56366 · Security Note
• https://bdu.fstec.ru/vul/2025-00503 · Security Note
• https://osv.dev/vulnerability/CVE-2024-56366 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c6fv-7vh8-2rhr · Vendor Advisory
• https://github.com/PHPOffice/PhpSpreadsheet · Note
• https://t.me/cvenotify/106200 · Telegram Post
• https://twitter.com/CveFindCom/status/1875233631305699339 · Twitter Post
• https://t.me/cvenotify/119201 · Telegram Post
• https://vuldb.com/?id.290170 · Note
• https://t.me/cvedetector/14232 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1875261160401817699 · Twitter Post
• https://twitter.com/CVEnew/status/1875233158461014245 · Twitter Post