CVE-2018-19277 XXE in PHPSpreadsheet due to encoding issue
Attackers can bypass XXE protections in PhpSpreadsheet by using UTF-7 encoding in .xlsx files, potentially leading to data exposure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-19277?
CVE-2018-19277 is a high-severity vulnerability in n/a, published on 14 Nov 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file
Weakness: CWE-91
Which versions are affected by CVE-2018-19277?
4 open source packages ship an affected version, including phpoffice/phpexcel and phpoffice/phpspreadsheet. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
phpoffice/phpexcel Packagist | All versions | 1.8.2 |
phpoffice/phpexcel Packagist | All versions | 1.8.2 |
phpoffice/phpspreadsheet Packagist | All versions | 1.5.1 |
phpoffice/phpspreadsheet Packagist | All versions | 1.5.1 |
Products include Phpoffice Phpspreadsheet.
How do I fix CVE-2018-19277?
Upgrade phpoffice/phpexcel to 1.8.2 or later.
Is CVE-2018-19277 being exploited?
There is no known exploitation of CVE-2018-19277 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
- CVE-2026-34084 PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load
- CVE-2024-45048 XML External Entity Reference (XXE) in PHPSpreadsheet
- CVE-2019-12331 XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue
- CVE-2024-56365 PhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader class
- CVE-2024-56366 PhpSpreadsheet vulnerable to unauthorized reflected XSS in the Accounting.php file
Sources
Also known as GHSA-xcrg-29h7-h4cj.