CVE-2018-19277

securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file

Score

CVSS 3.1 8.8 High

Status

Modified - cve@mitre.org

Published

2018-11-14

Last modified

2024-08-05

Weaknesses

CWE-91

Affected products

• Phpspreadsheet (Phpoffice)

References

• https://github.com/MewesK/TwigSpreadsheetBundle/issues/18
• https://github.com/PHPOffice/PhpSpreadsheet/issues/771
• https://www.bishopfox.com/news/2018/11/phpoffice-versions/
• https://www.drupal.org/sa-contrib-2021-043