phpoffice/phpexcel (Packagist)
Advisories
21
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 1.8.2 or later clears every advisory below that has a fix.
Upgrade commands
composer
composer require phpoffice/phpexcel:^1.8.2Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-r57h-547h-w24f PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters |
Medium EPSS 0.41% |
<= 1.8.2 | No fix yet |
| GHSA-79xx-vf93-p7cx Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet |
Medium EPSS 0.40% |
<= 1.8.2 | No fix yet |
| GHSA-q9jv-mm3r-j47r PhpSpreadsheet allows bypass XSS sanitizer using the javascript protocol and special characters |
Medium EPSS 0.39% |
<= 1.8.2 | No fix yet |
| GHSA-hwcp-2h35-p66w PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header |
Medium EPSS 0.37% |
<= 1.8.2 | No fix yet |
| GHSA-wv23-996v-q229 PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability in custom properties |
Medium EPSS 0.34% |
<= 1.8.2 | No fix yet |
| GHSA-j2xg-cjcx-4677 PhpSpreadsheet allows unauthorized Reflected XSS in Currency.php file |
Medium EPSS 0.34% |
<= 1.8.2 | No fix yet |
| GHSA-c6fv-7vh8-2rhr PhpSpreadsheet allows unauthorized Reflected XSS in the Accounting.php file |
Medium EPSS 0.34% |
<= 1.8.2 | No fix yet |
| GHSA-jmpx-686v-c3wx PhpSpreadsheet allows unauthorized Reflected XSS in the constructor of the Downloader class |
Medium EPSS 0.33% |
<= 1.8.2 | No fix yet |
| GHSA-x88g-h956-m5xg PhpSpreadsheet allows unauthorized Reflected XSS in `Convert-Online.php` file |
Medium EPSS 0.41% |
<= 1.8.2 | No fix yet |
| GHSA-7cc9-j4mv-vcjp XXE in PHPSpreadsheet's XLSX reader |
High EPSS 0.73% |
<= 1.8.2 | No fix yet |
| GHSA-jw4x-v69f-hh5w XmlScanner bypass leads to XXE |
High EPSS 0.76% |
<= 1.8.2 | No fix yet |
| GHSA-6hwr-6v2f-3m88 XXE in PHPSpreadsheet's XLSX reader |
High EPSS 2.78% |
<= 1.8.2 | No fix yet |
| GHSA-r8w8-74ww-j4wh PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks |
Medium EPSS 0.34% |
<= 1.8.2 | No fix yet |
| GHSA-w9xv-qf98-ccq4 PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled |
High EPSS 0.86% |
<= 1.8.2 | No fix yet |
| GHSA-5gpr-w2p5-6m37 PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery when opening XLSX file |
High EPSS 0.62% |
<= 1.8.2 | No fix yet |
| GHSA-v66g-p9x6-v98p PhpSpreadsheet has an Unauthenticated Cross-Site-Scripting (XSS) in sample file |
Medium EPSS 0.51% |
<= 1.8.2 | No fix yet |
| GHSA-ghg6-32f9-2jp7 XXE in PHPSpreadsheet encoding is returned |
Medium EPSS 0.60% |
<= 1.8.2 | No fix yet |
| GHSA-wgmf-q9vr-vww6 PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information |
Medium EPSS 0.42% |
<= 1.8.2 | No fix yet |
| GHSA-4mqv-gcr3-pff9 Cross-site scripting in phpoffice/phpspreadsheet |
Medium EPSS 1.32% |
<= 1.8.2 | No fix yet |
| GHSA-vvwv-h69m-wg6f XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue |
High EPSS 1.35% |
<= 1.8.2 | No fix yet |
| GHSA-xcrg-29h7-h4cj XXE in PHPSpreadsheet due to encoding issue |
High EPSS 7.79% |
< 1.8.2 | 1.8.2 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor