PT-2025-4368 · Unknown · Phpspreadsheet

Trikkss · Published 2024-12-23 · Updated 2025-10-27 · CVE-2025-22131

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PhpSpreadsheet (affected versions not specified)

Description The issue is related to a Cross-Site Scripting (XSS) vulnerability in the code that translates XLSX files into HTML representations and displays them in the response. This occurs when generating HTML from an XLSX file containing multiple sheets, where the sheet names are not sanitized, allowing an attacker to execute JavaScript code. The impact of this vulnerability can range from annoyance to complete account compromise, including disclosure of user session cookies, redirecting users to other pages, modifying content, automatically downloading malicious files, and requesting access to victim geolocation or camera.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-01639

CVE-2025-22131

GHSA-79XX-VF93-P7CX

Affected Products

Phpspreadsheet

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/22xxx/CVE-2025-22131.json · Exploit
• https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-79xx-vf93-p7cx · Vendor Advisory
• https://github.com/PHPOffice/PhpSpreadsheet/commit/4088381ccfaf241d7d42c333de0dc8c98e338743 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-22131 · Security Note
• https://osv.dev/vulnerability/CVE-2025-22131 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-01639 · Security Note
• https://osv.dev/vulnerability/GHSA-79xx-vf93-p7cx · Vendor Advisory
• https://github.com/PHPOffice/PhpSpreadsheet · Note
• https://vuldb.com/?id.292623 · Note
• https://t.me/cvenotify/107933 · Telegram Post
• https://twitter.com/transilienceai/status/1981926450480452090 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1881395738845814953 · Twitter Post
• https://t.me/cvedetector/15898 · Telegram Post
• https://reddit.com/r/CVEWatch/comments/1oggudz/top_10_trending_cves_26102025 · Reddit Post
• https://twitter.com/CVEnew/status/1881366195649331445 · Twitter Post