CVE-2024-47873: falha de alta gravidade em PHPOffice PhpSpreadsheet
PhpSpreadsheet XmlScanner bypass leads to XXE
Publicada em
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.7%
probabilidade de exploração
0.7%top 47% das CVEs
exploração observada
nãonenhuma fonte reporta
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. The XmlScanner class has a scan method which should prevent XXE attacks. However, prior to versions 1.9.4, 2.1.3, 2.3.2, and 3.4.0, the regexes used in the `scan` method and the findCharSet method can be bypassed by using UCS-4 and encoding guessing. An attacker can bypass the sanitizer and achieve an XML external entity attack. Versions 1.9.4, 2.1.3, 2.3.2, and 3.4.0 fix the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
PHPOffice · PhpSpreadsheetCVEs relacionadas — PHPOffice PhpSpreadsheet
No mesmo produto, das mais perigosas para as menos.
CVE-2024-45293HIGHXML External Entity Reference (XXE) in PHPSpreadsheet's XLSX readerEPSS 2.8%CVE-2024-45291MEDIUMPath traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled in PHPSpreadsheetEPSS 0.9%CVE-2025-54370HIGHPhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browserEPSS 0.8%CVE-2026-34084CRITICALPhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::loadEPSS 0.8%CVE-2024-48917HIGHXXE in PHPSpreadsheet's XLSX readerEPSS 0.7%CVE-2026-59932HIGHPhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustionEPSS 0.7%
Referências
https://github.com/PHPOffice/PhpSpreadsheet/blob/39fc51309181e82593b06e2fa8e45ef8333a0335/src/PhpSpreadsheet/Reader/Security/XmlScanner.phphttps://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-jw4x-v69f-hh5whttps://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processinghttps://www.w3.org/TR/xml/#sec-guessing-no-ext-info