PT-2024-10177 · Phpoffice · Phpspreadsheet

Aleksey Solovev

·

Published

2024-12-23

·

Updated

2025-04-21

·

CVE-2024-56365

CVSS v4.0

8.3

High

VectorAV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L
Name of the Vulnerable Software and Affected Versions PhpSpreadsheet versions prior to 3.7.0 PhpSpreadsheet versions prior to 2.3.5 PhpSpreadsheet versions prior to 2.1.6 PhpSpreadsheet versions prior to 1.29.7
Description The issue is related to unauthorized reflected cross-site scripting in the constructor of the Downloader class. An attacker can perform a cross-site scripting attack using the /vendor/phpoffice/phpspreadsheet/samples/download.php script. The vulnerability allows for the execution of arbitrary JavaScript code in the browser. The name and type variables are not properly sanitized, which can lead to exploitation.
Recommendations For versions prior to 3.7.0, update to version 3.7.0 or later. For versions prior to 2.3.5, update to version 2.3.5 or later. For versions prior to 2.1.6, update to version 2.1.6 or later. For versions prior to 1.29.7, update to version 1.29.7 or later. As a temporary workaround, consider sanitizing the name and type variables in the /vendor/phpoffice/phpspreadsheet/samples/download.php script to prevent exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-00504
CVE-2024-56365
GHSA-JMPX-686V-C3WX

Affected Products

Phpspreadsheet