CVE-2018-19277

XXE in PHPSpreadsheet due to encoding issue

8.8 HighPublic exploitFix available

securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

7.79%Up 4.2 points since Apr 14, 2021

What each source reports

NVD Score used 8.8

securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file

Record: CVE-2018-19277
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-91
Updated: 2026-11-02

CVE List No score

securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file

Record: CVE-2018-19277
Updated: 2026-11-02

EUVDEUVD-2019-0766 No score

securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file

Record: EUVD-2019-0766
Updated: 2026-11-03

GitHub AdvisoriesGHSA-xcrg-29h7-h4cj 8.8

XXE in PHPSpreadsheet due to encoding issue

securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file

Record: GHSA-xcrg-29h7-h4cj
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-91
Updated: 2026-11-02

OSV 8.8

securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file

Record: CVE-2018-19277
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-xcrg-29h7-h4cj 8.8

XXE in PHPSpreadsheet due to encoding issue

securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file

Record: GHSA-xcrg-29h7-h4cj
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-91
Updated: 2026-11-02

Affected products

phpoffice phpspreadsheet

Affected packages

Affected packages
Package	Affected	Fixed
`phpoffice/phpspreadsheet` Packagist	before 1.5.1	1.5.1
`phpoffice/phpexcel` Packagist	before 1.8.2	1.8.2
`phpoffice/phpspreadsheet` Packagist	before 1.5.1, plus listed versions 1.0.01.0.0-beta1.0.0-beta21.1.01.2.0 Show 6 moreShow less 1.2.11.3.01.3.11.4.01.4.11.5.0	1.5.1
`phpoffice/phpexcel` Packagist	before 1.8.2, plus listed versions 1.7.91.7.9-rc11.8.01.8.0rc11.8.0rc21.8.0rc31.8.0rc41.8.1	1.8.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	PhpSpreadsheet < 1.5.0 - XML External Entity (XXE)	2018-11-30

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-19277 is a high vulnerability (CVSS 8.8) in Phpoffice Phpspreadsheet, published November 14, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 7.79%, the 94th percentile. Fixed in phpoffice/phpspreadsheet 1.5.1.

References

Show 7 moreShow less