UpHeron
All vulnerabilities

Packagist

CVE-2026-35453

PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer

Severity
Medium
Published
28 Apr 2026
Last changed
8 May 2026
Added to UpHeron
22 Oct 2026
Fixed in
1.30.4, 2.1.16, 2.4.5, 3.10.5, 5.7.0
Also known as
GHSA-6wpp-88cp-7q68
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
phpoffice/phpspreadsheetPackagist · osv:Packagist:phpoffice/phpspreadsheet
  • Every version before 1.30.4
  • From 2.0.0 before 2.1.16
  • From 2.2.0 before 2.4.5
  • From 3.3.0 before 3.10.5
  • From 4.0.0 before 5.7.0

References