UpHeron
All vulnerabilities

Packagist

CVE-2026-40296

PhpSpreadsheet has XSS via number format code with @ text placeholder bypasses htmlspecialchars in HTML writer

Severity
Medium 5.4
Published
28 Apr 2026
Last changed
8 May 2026
Added to UpHeron
22 Oct 2026
Fixed in
1.30.4, 2.1.16, 2.4.5, 3.10.5, 5.7.0
Also known as
GHSA-hrmw-qprp-wgmc
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
phpoffice/phpspreadsheetPackagist · osv:Packagist:phpoffice/phpspreadsheet
  • Every version before 1.30.4
  • From 2.0.0 before 2.1.16
  • From 2.2.0 before 2.4.5
  • From 3.3.0 before 3.10.5
  • From 4.0.0 before 5.7.0

References