GHSA-vvwv-h69m-wg6f CVE-2019-12331
XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue
- Severity
- 8.8 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 1.35%
- Chance of exploitation in the next 30 days. Higher than 71.50% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-611 Improper Restriction of XML External Entity Reference
- Fix
1.8.0- Upgrade phpoffice/phpspreadsheet to this version or later
Description
PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared in the header. This was a security measurement to prevent CVE-2018-19277 but the fix is not sufficient. By double-encoding the the xml payload to utf-7 it is possible to bypass the check for the string ?<!ENTITY? and thus allowing for an xml external entity processing (XXE) attack.
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| phpoffice/phpexcel | <= 1.8.2 |
No fix yet |
| phpoffice/phpspreadsheet | < 1.8.0 |
1.8.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
phpoffice/phpspreadsheet Packagist → 1.8.0
- composer
composer require phpoffice/phpspreadsheet:^1.8.0
Severity breakdown
CVSS 3.1 8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-611: Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
How to prevent it
- Implementation, System Configuration: Many XML parsers and validators can be configured to disable external entity expansion.
References
Advisories
Packages
Other links
- github.com/PHPOffice/PhpSpreadsheet/pull/1041
- github.com/PHPOffice/PhpSpreadsheet/commit/0e6238c69e863b58aeece61e48ea032696c6…
- github.com/FriendsOfPHP/security-advisories/blob/master/phpoffice/phpspreadshee…
- github.com/PHPOffice/PhpSpreadsheet/blob/master/CHANGELOG.md
- github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.8.0
- herolab.usd.de/security-advisories/usd-2019-0046
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-2phh-27fw-q4gc PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading | Medium | Also affects phpoffice/phpspreadsheet |
| GHSA-j2w7-387v-m2rq PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS) | High | Also affects phpoffice/phpspreadsheet |
| GHSA-3x94-m842-937c PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service | High | Also affects phpoffice/phpspreadsheet |
| GHSA-rxj4-h86g-25gc PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service | High | Also affects phpoffice/phpspreadsheet |
| GHSA-xh5m-36r6-47m3 PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion | High | Also affects phpoffice/phpspreadsheet |
| GHSA-2mrg-gjxq-2gvr PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion | High | Also affects phpoffice/phpspreadsheet |
| GHSA-6hq5-7373-42rg PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist | High | Also affects phpoffice/phpspreadsheet |
| GHSA-87m4-826x-3crx PHPSpreadsheet has a patch bypass for CVE-2026-34084 | Critical | Also affects phpoffice/phpspreadsheet |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor