Medium severity · published Aug 28, 2024
CVE-2024-45048
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files
6.5
CVSS
0.6%
EPSS
No
On KEV
Description
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions are subject to a bypassing of a filter which allows for an XXE-attack. This in turn allows attacker to obtain contents of local files, even if error reporting is muted. This vulnerability has been addressed in release version 2.2.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
Phpspreadsheet · Phpoffice
before 1.29.1; 2.0.0 before 2.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-45048
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-45048
Patch
https://github.com/PHPOffice/PhpSpreadsheet/commit/bea2d4b30f24bcc8a7712e208d1359e603b45dda
Exploit
https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-ghg6-32f9-2jp7
More from Phpspreadsheet
9.8
CVE-2026-34084
PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load
9.2
CVE-2026-45034
PhpSpreadsheet: File::prohibitWrappers bypass
8.8
CVE-2026-108357
PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service
8.8
CVE-2026-108358
PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service
8.8
CVE-2024-45291
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files