p PatchFirst

CVE-2018-19277

CVE-2018-19277

This page contains facts from public vulnerability sources. Check the original advisory before updating.

securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file

CVSS 8.8 · High · EPSS 7.8% · Public exploit · Fix available

Published
Updated

Stack: php

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • phpoffice/phpspreadsheet Packagist

    Versions
    • 1.0.0
    • 1.0.0-beta
    • 1.0.0-beta2
    • 1.1.0
    • 1.2.0
    • 1.2.1
    • 1.3.0
    • 1.3.1
    • 1.4.0
    • 1.4.1
    • 1.5.0
    Affected ranges
    • ECOSYSTEM: < 1.5.1

    Update to 1.5.1

  • phpoffice/phpexcel Packagist

    Versions
    • 1.7.9
    • 1.7.9-rc1
    • 1.8.0
    • 1.8.0rc1
    • 1.8.0rc2
    • 1.8.0rc3
    • 1.8.0rc4
    • 1.8.1
    Affected ranges
    • ECOSYSTEM: < 1.8.2

    Update to 1.8.2

Original sources

Check your server →