CVE-2026-40296— PhpSpreadsheet vulnerable to XSS in HTML writer via custom number format codes

PhpSpreadsheet vulnerable to XSS in HTML writer via custom number format codes

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The HTML writer skips htmlspecialchars escaping when a cell's formatted value differs from the original value. When a cell has a custom number format containing the text placeholder @ along with any additional literal characters (for example ". @", "@ ", or "x@"), the formatter replaces @ with the cell value and adds the extra characters, causing the formatted value to differ from the original and bypassing HTML escaping entirely. An attacker who can control the cell value and number format of an uploaded spreadsheet that is later converted to HTML and displayed to other users can achieve stored cross-site scripting. This issue is fixed in versions 5.7.0, 3.10.5, 2.4.5, 2.1.16, and 1.30.4.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

PhpSpreadsheet 跨站脚本漏洞

PhpSpreadsheet是PHPOffice开源的一款用于读取和写入电子表格文件的PHP库。 PhpSpreadsheet 5.7.0之前版本、3.10.5之前版本、2.4.5之前版本、2.1.16之前版本和1.30.4之前版本存在跨站脚本漏洞，该漏洞源于HTML写入器在单元格格式化值与原始值不同时跳过htmlspecialchars转义，可能导致攻击者通过控制单元格值和数字格式实现存储型跨站脚本。

N/A

N/A