{"id":"GHSA-hq76-662x-7mw4","aliases":[],"status":"published","title":"Pimcore includes vulnerable PHPOffice/PhpSpreadsheet","description":"### Summary\nPimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: [GHSA-ghg6-32f9-2jp7](https://github.com/advisories/GHSA-ghg6-32f9-2jp7).","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2024-09-03T19:45:26Z","modified":"2024-12-05T05:28:51Z","fixes":[{"ecosystem":"Packagist","package":"pimcore/data-importer","fixed_in":["1.8.9","1.9.3"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"pimcore/admin-ui-classic-bundle","fixed_in":["1.3.11","1.4.7","1.5.4"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"pimcore/pimcore","fixed_in":["10.6.9.12","11.1.6.11"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"pimcore/data-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.9"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"pimcore/data-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.0"},{"fixed":"1.9.3"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"pimcore/admin-ui-classic-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.11"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"pimcore/admin-ui-classic-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.7"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"pimcore/admin-ui-classic-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0"},{"fixed":"1.5.4"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"pimcore/pimcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.6.9.0"},{"fixed":"10.6.9.12"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"pimcore/pimcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.1.0.0"},{"fixed":"11.1.6.11"}]}]},{"source":"osv","ecosystem":"Packagist","package":"pimcore/data-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.9"}]}],"versions":["v1.0","v1.0.1","v1.1","v1.1.1","v1.1.2","v1.1.3","v1.1.4","v1.1.5","v1.2.0","v1.2.1","v1.2.2","v1.3.0","v1.3.1","v1.3.2","v1.3.3","v1.3.4","v1.3.5","v1.3.6","v1.4.0","v1.4.1","v1.4.2","v1.4.3","v1.4.4","v1.4.5","v1.4.6","v1.5.0","v1.5.1","v1.6.0","v1.6.1","v1.6.2","v1.6.3","v1.6.4","v1.6.5","v1.7.0","v1.7.1","v1.7.2","v1.7.3","v1.7.4","v1.7.5","v1.8.0","v1.8.0-BETA1","v1.8.0-RC1","v1.8.1","v1.8.2","v1.8.3","v1.8.4","v1.8.5","v1.8.6","v1.8.7","v1.8.8"]},{"source":"osv","ecosystem":"Packagist","package":"pimcore/data-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.0"},{"fixed":"1.9.3"}]}],"versions":["v1.9.0","v1.9.1","v1.9.2"]},{"source":"osv","ecosystem":"Packagist","package":"pimcore/admin-ui-classic-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.11"}]}],"versions":["v1.0.0","v1.0.0-BETA1","v1.0.0-RC1","v1.0.0-RC2","v1.0.1","v1.0.2","v1.0.3","v1.0.4","v1.0.5","v1.0.6","v1.1.0","v1.1.0-RC1","v1.1.1","v1.1.2","v1.1.3","v1.1.4","v1.2","v1.2.0-RC1","v1.2.1","v1.2.2","v1.2.3","v1.3.0","v1.3.0-RC1","v1.3.1","v1.3.2","v1.3.3","v1.3.4","v1.3.5"]},{"source":"osv","ecosystem":"Packagist","package":"pimcore/admin-ui-classic-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.7"}]}],"versions":["1.4.0","v1.4.1","v1.4.2","v1.4.3","v1.4.4","v1.4.5"]},{"source":"osv","ecosystem":"Packagist","package":"pimcore/admin-ui-classic-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0"},{"fixed":"1.5.4"}]}],"versions":["v1.5.0","v1.5.1","v1.5.2","v1.5.3"]},{"source":"osv","ecosystem":"Packagist","package":"pimcore/pimcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.6.9.0"},{"fixed":"10.6.9.12"}]}]},{"source":"osv","ecosystem":"Packagist","package":"pimcore/pimcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.1.0.0"},{"fixed":"11.1.6.11"}]}],"versions":["v11.1.1","v11.1.2","v11.1.3","v11.1.4","v11.1.5","v11.1.6"]}],"references":[{"url":"https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4","tags":["web"]},{"url":"https://github.com/advisories/GHSA-ghg6-32f9-2jp7","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hq76-662x-7mw4"},{"url":"https://github.com/pimcore/pimcore","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-hq76-662x-7mw4","title":"Pimcore includes vulnerable PHPOffice/PhpSpreadsheet","description":"### Summary\nPimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: [GHSA-ghg6-32f9-2jp7](https://github.com/advisories/GHSA-ghg6-32f9-2jp7).\n\n","status":"published","published":"2024-09-03T19:45:26Z","modified":"2024-09-03T19:45:27Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:38:00.257632Z"}],"osv":[{"id":"GHSA-hq76-662x-7mw4","title":"Pimcore includes vulnerable PHPOffice/PhpSpreadsheet","description":"### Summary\nPimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: [GHSA-ghg6-32f9-2jp7](https://github.com/advisories/GHSA-ghg6-32f9-2jp7).\n\n","status":"published","published":"2024-09-03T19:45:26Z","modified":"2024-12-05T05:28:51.120085Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:46:49.28217Z"}]}}