p PatchFirst

CVE-2024-56412

CVE-2024-56412 · PhpSpreadsheet vulnerable to bypass of the XSS sanitizer using the javascript protocol and special characters

This page contains facts from public vulnerability sources. Check the original advisory before updating.

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to bypass of the cross-site scripting sanitizer using the javascript protocol and special characters. An attacker can use special characters, so that the library processes the javascript protocol with special characters and generates an HTML link. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.

CVSS 4.8 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • phpspreadsheet

    Versions
    • >= 3.0.0, < 3.7.0: Affected
    • < 1.29.7: Affected
    • >= 2.0.0, < 2.1.6: Affected
    • >= 2.2.0, < 2.3.5: Affected

    No fix published

  • phpoffice/phpspreadsheet Packagist

    Versions
    • 3.3.0
    • 3.4.0
    • 3.5.0
    • 3.6.0
    Affected ranges
    • ECOSYSTEM: ≥ 3.0.0, < 3.7.0

    Update to 3.7.0

  • phpoffice/phpspreadsheet Packagist

    Versions
    • 1.0.0
    • 1.0.0-beta
    • 1.0.0-beta2
    • 1.1.0
    • 1.10.0
    • 1.10.1
    • 1.11.0
    • 1.12.0
    • 1.13.0
    • 1.14.0
    • 1.14.1
    • 1.15.0
    • 1.16.0
    • 1.17.0
    • 1.17.1
    • 1.18.0
    • 1.19.0
    • 1.2.0
    • 1.2.1
    • 1.20.0
    • 1.21.0
    • 1.22.0
    • 1.23.0
    • 1.24.0
    • 1.24.1
    • 1.25.0
    • 1.25.1
    • 1.25.2
    • 1.26.0
    • 1.27.0
    • 1.27.1
    • 1.28.0
    • 1.29.0
    • 1.29.1
    • 1.29.2
    • 1.29.4
    • 1.29.5
    • 1.29.6
    • 1.3.0
    • 1.3.1
    • 1.4.0
    • 1.4.1
    • 1.5.0
    • 1.5.1
    • 1.5.2
    • 1.6.0
    • 1.7.0
    • 1.8.0
    • 1.8.1
    • 1.8.2
    • 1.9.0
    Affected ranges
    • ECOSYSTEM: < 1.29.7

    Update to 1.29.7

  • phpoffice/phpspreadsheet Packagist

    Versions
    • 2.0.0
    • 2.1.0
    • 2.1.1
    • 2.1.3
    • 2.1.4
    • 2.1.5
    Affected ranges
    • ECOSYSTEM: ≥ 2.0.0, < 2.1.6

    Update to 2.1.6

  • phpoffice/phpspreadsheet Packagist

    Versions
    • 2.2.0
    • 2.2.1
    • 2.2.2
    • 2.3.0
    • 2.3.2
    • 2.3.3
    • 2.3.4
    Affected ranges
    • ECOSYSTEM: ≥ 2.2.0, < 2.3.5

    Update to 2.3.5

  • phpoffice/phpexcel Packagist

    Versions
    • 1.7.9
    • 1.7.9-rc1
    • 1.8.0
    • 1.8.0rc1
    • 1.8.0rc2
    • 1.8.0rc3
    • 1.8.0rc4
    • 1.8.1
    • 1.8.2
    Affected ranges
    • ECOSYSTEM: ≤ 1.8.2

    No fix published

Original sources

Check your server →