HIGH8.8
GHSA-xcrg-29h7-h4cj
XXE in PHPSpreadsheet due to encoding issue
Quick fix
GHSA-xcrg-29h7-h4cj — phpoffice/phpspreadsheet: upgrade to the fixed version with the command below.
composer require phpoffice/phpspreadsheet:^1.5.1Details
securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/phpoffice/phpspreadsheet
Introduced in:
0Fixed in: 1.5.1Fix
composer require phpoffice/phpspreadsheet:^1.5.1Packagist/phpoffice/phpexcel
Introduced in:
0Fixed in: 1.8.2Fix
composer require phpoffice/phpexcel:^1.8.2References
- https://nvd.nist.gov/vuln/detail/CVE-2018-19277[ADVISORY]
- https://github.com/MewesK/TwigSpreadsheetBundle/issues/18[WEB]
- https://github.com/PHPOffice/PhpSpreadsheet/issues/771[WEB]
- https://github.com/PHPOffice/PhpSpreadsheet/pull/780[WEB]
- https://github.com/PHPOffice/PHPExcel/commit/2b601574975acfb9d4378a788ed5f2b747958095[WEB]
- https://github.com/PHPOffice/PhpSpreadsheet/commit/0f8f071e24ee8b114d894ac172f77dc250e5bfa4[WEB]
- https://github.com/FriendsOfPHP/security-advisories/blob/master/phpoffice/phpspreadsheet/CVE-2018-19277.yaml[WEB]
- https://github.com/PHPOffice/PHPExcel/commits/1.8.2[WEB]
- https://github.com/PHPOffice/PhpSpreadsheet[PACKAGE]
- https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.5.1[WEB]
- https://www.bishopfox.com/news/2018/11/phpoffice-versions[WEB]
- https://www.drupal.org/sa-contrib-2021-043[WEB]