CVE-2024-56365

Name of the Vulnerable Software and Affected Versions PhpSpreadsheet versions prior to 3.7.0 PhpSpreadsheet versions prior to 2.3.5 PhpSpreadsheet versions prior to 2.1.6 PhpSpreadsheet versions prior to 1.29.7

Description The issue is related to unauthorized reflected cross-site scripting in the constructor of the Downloader class. An attacker can perform a cross-site scripting attack using the /vendor/phpoffice/phpspreadsheet/samples/download.php script. The vulnerability allows for the execution of arbitrary JavaScript code in the browser. The name and type variables are not properly sanitized, which can lead to exploitation.

Recommendations For versions prior to 3.7.0, update to version 3.7.0 or later. For versions prior to 2.3.5, update to version 2.3.5 or later. For versions prior to 2.1.6, update to version 2.1.6 or later. For versions prior to 1.29.7, update to version 1.29.7 or later. As a temporary workaround, consider sanitizing the name and type variables in the /vendor/phpoffice/phpspreadsheet/samples/download.php script to prevent exploitation.