CVE-2025-22131: Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet

January 21, 2025 (updated March 6, 2025)

The researcher discovered zero-day vulnerability Cross-Site Scripting (XSS) vulnerability in the code which translates the XLSX file into a HTML representation and displays it in the response.

References

github.com/PHPOffice/PhpSpreadsheet
github.com/PHPOffice/PhpSpreadsheet/commit/4088381ccfaf241d7d42c333de0dc8c98e338743
github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-79xx-vf93-p7cx
github.com/advisories/GHSA-79xx-vf93-p7cx
nvd.nist.gov/vuln/detail/CVE-2025-22131

Code Behaviors & Features

Detect and mitigate CVE-2025-22131 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →