Description
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have a cross-site scripting (XSS) vulnerability in custom properties. The HTML page is generated without clearing custom properties. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.
Published: 2025-01-03
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-0050 PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have a cross-site scripting (XSS) vulnerability in custom properties. The HTML page is generated without clearing custom properties. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.
Github GHSA Github GHSA GHSA-wv23-996v-q229 PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability in custom properties
History

Thu, 17 Apr 2025 05:00:00 +0200

Type Values Removed Values Added
First Time appeared Phpoffice
Phpoffice phpspreadsheet
CPEs cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*
Vendors & Products Phpoffice
Phpoffice phpspreadsheet
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

Fri, 03 Jan 2025 22:45:00 +0100

Type Values Removed Values Added
References

Fri, 03 Jan 2025 21:30:00 +0100

Type Values Removed Values Added
References

Fri, 03 Jan 2025 19:15:00 +0100

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 03 Jan 2025 18:30:00 +0100

Type Values Removed Values Added
Description PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have a cross-site scripting (XSS) vulnerability in custom properties. The HTML page is generated without clearing custom properties. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.
Title PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability in custom properties
Weaknesses CWE-79
References
Metrics cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N'}

Subscriptions

Phpoffice Phpspreadsheet
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2025-01-03T20:11:13.518Z

Reserved: 2024-12-23T15:07:48.510Z

Link: CVE-2024-56410

cve-icon Vulnrichment

Updated: 2025-01-03T18:01:33.807Z

cve-icon NVD

Status : Analyzed

Published: 2025-01-03T18:15:15.987

Modified: 2026-06-17T08:12:09.397

Link: CVE-2024-56410

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')