CVE-2026-40296 PhpSpreadsheet vulnerable to XSS in HTML writer via custom number format codes
Attackers can achieve stored XSS by crafting spreadsheet cells with specific custom number formats that bypass HTML escaping during conversion.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-40296?
CVE-2026-40296 is a medium-severity cross-site scripting vulnerability in PHPOffice PhpSpreadsheet, published on 6 May 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The HTML writer skips htmlspecialchars escaping when a cell's formatted value differs from the original value. When a cell has a custom number format containing the text placeholder @ along with any additional literal characters (for example ". @", "@ ", or "x@"), the formatter replaces @ with the cell value and adds the extra characters, causing the formatted value to differ from the original and bypassing HTML escaping entirely. An attacker who can control the cell value and number format of an uploaded spreadsheet that is later converted to HTML and displayed to other users can achieve stored cross-site scripting. This issue is fixed in versions 5.7.0, 3.10.5, 2.4.5, 2.1.16, and 1.30.4.
Weakness: CWE-79
Which versions are affected by CVE-2026-40296?
10 open source packages ship an affected version, including phpoffice/phpspreadsheet. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
phpoffice/phpspreadsheet Packagist | All versions | 1.30.4 |
phpoffice/phpspreadsheet Packagist | All versions | 1.30.4 |
phpoffice/phpspreadsheet Packagist | From 2.0.0 | 2.1.16 |
phpoffice/phpspreadsheet Packagist | From 2.0.0 | 2.1.16 |
phpoffice/phpspreadsheet Packagist | From 2.2.0 | 2.4.5 |
phpoffice/phpspreadsheet Packagist | From 2.2.0 | 2.4.5 |
4 more packages
phpoffice/phpspreadsheet Packagist | From 3.3.0 | 3.10.5 |
phpoffice/phpspreadsheet Packagist | From 3.3.0 | 3.10.5 |
phpoffice/phpspreadsheet Packagist | From 4.0.0 | 5.7.0 |
phpoffice/phpspreadsheet Packagist | From 4.0.0 | 5.7.0 |
Products include Phpoffice Phpspreadsheet.
How do I fix CVE-2026-40296?
Upgrade phpoffice/phpspreadsheet to a fixed version for your release line: 1.30.4, 2.1.16, 2.4.5 or 3.10.5.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-40296 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40296 exists.
Other vulnerabilities in PHPOffice PhpSpreadsheet
- CVE-2026-34084 PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load
- CVE-2024-45048 XML External Entity Reference (XXE) in PHPSpreadsheet
- CVE-2019-12331 XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue
- CVE-2018-19277 XXE in PHPSpreadsheet due to encoding issue
- CVE-2024-56365 PhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader class
Sources
Also known as GHSA-hrmw-qprp-wgmc.