CVE-2019-12331 XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue

What is CVE-2019-12331?

CVE-2019-12331 is a high-severity vulnerability in n/a, published on 7 Nov 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared in the header. This was a security measurement to prevent CVE-2018-19277 but the fix is not sufficient. By double-encoding the the xml payload to utf-7 it is possible to bypass the check for the string ‚<!ENTITY‘ and thus allowing for an xml external entity processing (XXE) attack.

Weakness: CWE-611

Which versions are affected by CVE-2019-12331?

4 open source packages ship an affected version, including phpoffice/phpexcel and phpoffice/phpspreadsheet. It affects 1 product.

Products include Phpoffice Phpspreadsheet.

How do I fix CVE-2019-12331?

Upgrade to a fixed version.

Is CVE-2019-12331 being exploited?

There is no known exploitation of CVE-2019-12331 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2026-34084 PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load Critical 9.2
• CVE-2024-45048 XML External Entity Reference (XXE) in PHPSpreadsheet High 8.8
• CVE-2018-19277 XXE in PHPSpreadsheet due to encoding issue High 8.8
• CVE-2024-56365 PhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader class High 8.3
• CVE-2024-56366 PhpSpreadsheet vulnerable to unauthorized reflected XSS in the Accounting.php file High 8.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vvwv-h69m-wg6f.