CVE-2024-45048CWE-611

XML External Entity Reference (XXE) in PHPSpreadsheet

High · published August 28, 2024

CVSS v3.1
8.8
EPSS
1%
Percentile
48.3
In the wild
Unconfirmed
What it is

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions are subject to a bypassing of a filter which allows for an XXE-attack. This in turn allows attacker to obtain contents of local files, even if error reporting is muted. This vulnerability has been addressed in release version 2.2.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00605 · 48.3th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2024-08-28T20:38Z
EPSS history
Timeline
  • 28 AUG 20:38Z
    XML External Entity Reference (XXE) in PHPSpreadsheet
    cvelistv5