CVE-2024-45048: high-severity vulnerability in PHPOffice PhpSpreadsheet
XML External Entity Reference (XXE) in PHPSpreadsheet
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 0.6%
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions are subject to a bypassing of a filter which allows for an XXE-attack. This in turn allows attacker to obtain contents of local files, even if error reporting is muted. This vulnerability has been addressed in release version 2.2.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
PHPOffice · PhpSpreadsheetRelated CVEs — PHPOffice PhpSpreadsheet
In the same product, most dangerous first.
CVE-2024-45293HIGHXML External Entity Reference (XXE) in PHPSpreadsheet's XLSX readerEPSS 2.8%CVE-2024-45291MEDIUMPath traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled in PHPSpreadsheetEPSS 0.9%CVE-2025-54370HIGHPhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browserEPSS 0.8%CVE-2024-47873HIGHPhpSpreadsheet XmlScanner bypass leads to XXEEPSS 0.8%CVE-2024-48917HIGHXXE in PHPSpreadsheet's XLSX readerEPSS 0.7%CVE-2026-34084CRITICALPhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::loadEPSS 0.7%