GHSA-xcrg-29h7-h4cj CVE-2018-19277
XXE in PHPSpreadsheet due to encoding issue
High
Packagist
- Severity
- 8.8 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 7.79%
- Chance of exploitation in the next 30 days. Higher than 94.66% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-91 XML Injection (aka Blind XPath Injection)
- Fix
- Available
- 2 packages have a fixed version
Description
securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| phpoffice/phpexcel | < 1.8.2 |
1.8.2 |
| phpoffice/phpspreadsheet | < 1.5.1 |
1.5.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
phpoffice/phpexcel Packagist → 1.8.2
- composer
composer require phpoffice/phpexcel:^1.8.2
phpoffice/phpspreadsheet Packagist → 1.5.1
- composer
composer require phpoffice/phpspreadsheet:^1.5.1
Severity breakdown
CVSS 3.1 8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-91: XML Injection (aka Blind XPath Injection)
The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
How to prevent it
- Implementation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
References
Advisories
Packages
Other links
- github.com/MewesK/TwigSpreadsheetBundle/issues/18
- github.com/PHPOffice/PhpSpreadsheet/issues/771
- github.com/PHPOffice/PhpSpreadsheet/pull/780
- github.com/PHPOffice/PHPExcel/commit/2b601574975acfb9d4378a788ed5f2b747958095
- github.com/PHPOffice/PhpSpreadsheet/commit/0f8f071e24ee8b114d894ac172f77dc250e5…
- github.com/FriendsOfPHP/security-advisories/blob/master/phpoffice/phpspreadshee…
- github.com/PHPOffice/PHPExcel/commits/1.8.2
- github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.5.1
- bishopfox.com/news/2018/11/phpoffice-versions
- drupal.org/sa-contrib-2021-043
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-2phh-27fw-q4gc PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading | Medium | Also affects phpoffice/phpspreadsheet |
| GHSA-j2w7-387v-m2rq PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS) | High | Also affects phpoffice/phpspreadsheet |
| GHSA-3x94-m842-937c PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service | High | Also affects phpoffice/phpspreadsheet |
| GHSA-rxj4-h86g-25gc PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service | High | Also affects phpoffice/phpspreadsheet |
| GHSA-xh5m-36r6-47m3 PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion | High | Also affects phpoffice/phpspreadsheet |
| GHSA-2mrg-gjxq-2gvr PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion | High | Also affects phpoffice/phpspreadsheet |
| GHSA-6hq5-7373-42rg PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist | High | Also affects phpoffice/phpspreadsheet |
| GHSA-87m4-826x-3crx PHPSpreadsheet has a patch bypass for CVE-2026-34084 | Critical | Also affects phpoffice/phpspreadsheet |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor