Composer phpoffice/phpexcel has 23 known advisories in the phpwarden feed. Feed 2026.10.29.4, updated 2026-10-29.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2018-19277 | XXE in PHPSpreadsheet due to encoding issue | high | 8.8 | <1.8.2 or <1.8.0 | 1.8.2 |
| CVE-2024-45293 | XXE in PHPSpreadsheet's XLSX reader | high | 7.5 | <=1.8.2 | – |
| CVE-2014-2054 | PHPExcel vulnerable to XXE attacks through libxml | medium | 0.0 | <1.8.0 | 1.8.0 |
| CVE-2019-12331 | XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue | high | 8.8 | <=1.8.2 | – |
| CVE-2020-7776 | Cross-site scripting in phpoffice/phpspreadsheet | medium | 6.4 | <=1.8.2 | – |
| CVE-2024-45291 | PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled | medium | 6.3 | <=1.8.2 | – |
| CVE-2024-47873 | XmlScanner bypass leads to XXE | high | 7.5 | <=1.8.2 | – |
| CVE-2024-48917 | XXE in PHPSpreadsheet's XLSX reader | high | 7.5 | <=1.8.2 | – |
| CVE-2024-45290 | PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery when opening XLSX file | high | 7.7 | <=1.8.2 | – |
| CVE-2024-45048 | XXE in PHPSpreadsheet encoding is returned | high | 8.8 | <=1.8.2 | – |
| CVE-2024-45060 | PhpSpreadsheet has an Unauthenticated Cross-Site-Scripting (XSS) in sample file | medium | 6.1 | <=1.8.2 | – |
| CVE-2024-45046 | PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information | medium | 5.4 | <=1.8.2 | – |
| CVE-2025-23210 | PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters | medium | 5.4 | <=1.8.2 | – |
| CVE-2024-56408 | PhpSpreadsheet allows unauthorized Reflected XSS in `Convert-Online.php` file | high | 7.1 | <=1.8.2 | – |
| CVE-2025-22131 | Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet | medium | 6.1 | <=1.8.2 | – |
| CVE-2024-56412 | PhpSpreadsheet allows bypass XSS sanitizer using the javascript protocol and special characters | medium | 5.4 | <=1.8.2 | – |
| CVE-2024-56411 | PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header | medium | 5.4 | <=1.8.2 | – |
| CVE-2024-45292 | PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks | medium | 5.4 | <=1.8.2 | – |
| CVE-2024-56366 | PhpSpreadsheet allows unauthorized Reflected XSS in the Accounting.php file | high | 7.1 | <=1.8.2 | – |
| CVE-2024-56409 | PhpSpreadsheet allows unauthorized Reflected XSS in Currency.php file | high | 7.1 | <=1.8.2 | – |
| CVE-2024-56410 | PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability in custom properties | medium | 5.4 | <=1.8.2 | – |
| CVE-2024-56365 | PhpSpreadsheet allows unauthorized Reflected XSS in the constructor of the Downloader class | high | 7.1 | <=1.8.2 | – |
| CVE-2015-3542 | PHPExcel XXE Vulnerability | high | 0.0 | <1.8.1 | 1.8.1 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# PHP projects (recommended) composer require --dev phpwarden/phpwarden # then vendor/bin/phpwarden deps composer.lock # or, without Composer pipx install phpwarden && phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked