CVE-2024-45048: XXE in PHPSpreadsheet encoding is returned

August 29, 2024 (updated March 6, 2025)

Bypassing the filter allows a XXE-attack. Which is turn allows attacker to obtain contents of local files, even if error reporting muted by @ symbol. (LFI-attack)

References

github.com/PHPOffice/PhpSpreadsheet
github.com/PHPOffice/PhpSpreadsheet/commit/bea2d4b30f24bcc8a7712e208d1359e603b45dda
github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-ghg6-32f9-2jp7
github.com/advisories/GHSA-ghg6-32f9-2jp7
nvd.nist.gov/vuln/detail/CVE-2024-45048

Code Behaviors & Features

Detect and mitigate CVE-2024-45048 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →