Vulnerability · Published Jan 20, 2025 · Assigned by GitHub_M
CVE-2025-22131Cross-Site Scripting (XSS) vulnerability in generateNavigation() function
Medium 5.1
In plain English
A medium-severity cross-site scripting in PhpSpreadsheet from PHPOffice. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)5.1Medium
Exploit odds (30 days)0.4%top 66.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC
Official description
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Cross-Site Scripting (XSS) vulnerability in the code which translates the XLSX file into a HTML representation and displays it in the response.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | phpoffice/phpexcel | no fix listed | GHSA-79xx-vf93-p7cx |
| Packagist | phpoffice/phpspreadsheet | 3.8.0 | GHSA-79xx-vf93-p7cx |
| Packagist | phpoffice/phpspreadsheet | 1.29.8 | GHSA-79xx-vf93-p7cx |
| Packagist | phpoffice/phpspreadsheet | 2.1.7 | GHSA-79xx-vf93-p7cx |
| Packagist | phpoffice/phpspreadsheet | 2.3.6 | GHSA-79xx-vf93-p7cx |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PHPOffice | PhpSpreadsheet | >= 3.0.0, < 3.8.0>= 2.2.0, < 2.3.6>= 2.0.0, < 2.1.7< 1.29.8 |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N