XXE in PHPSpreadsheet due to encoding issue

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2018-19277 · ADVISORY
• MewesK/TwigSpreadsheetBundle · WEB
• PHPOffice/PhpSpreadsheet · WEB
• PHPOffice/PhpSpreadsheet#780 · WEB
• PHPOffice/PHPExcel commit 2b60157 · WEB
• PHPOffice/PhpSpreadsheet commit 0f8f071 · WEB
• FriendsOfPHP/security-advisories · WEB
• PHPOffice/PHPExcel · WEB
• PHPOffice/PhpSpreadsheet · PACKAGE
• PHPOffice/PhpSpreadsheet release 1.5.1 · WEB
• bishopfox.com/news/2018/11/phpoffice-versions · WEB
• drupal.org/sa-contrib-2021-043

phpoffice/phpexcel のその他の脆弱性

• CVE-2025-23210中 4.8phpoffice/phpspreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions have been found to have a Bypass…
• CVE-2025-22131中 6.1PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Cross-Site Scripting (XSS) vulnerability in the code which transl…
• CVE-2024-56412中 5.4PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable …
• CVE-2024-56411中 5.4PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have a cross-si…
• CVE-2024-56410中 5.4PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have a cross-si…