PHPSpreadsheet Library < 2.3.0 - XXE Injection
highThe security scanner that prevents XXE attacks in the XLSX reader can be bypassed by slightly modifying the XML structure, utilizing white spaces. On servers that allow users to upload their own Excel (XLSX) sheets, Server files, and sensitive information can be disclosed by providing a crafted sheet.
- CVSS:
- 7.5
- Affected:
- up to 5.9
- Fixed in:
- 6.0
- Disclosed:
- Oct 7, 2024