CVE-2024-56366

What it is

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the `Accounting.php` file. Using the `/vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Accounting.php` script, an attacker can perform a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.

At a glance

Exploitability

Can be exploited over the network without logging in, but needs a user to act. High risk of data tampering.

Exploit odds

0.3% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2025-01-03 17:15 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-06-17 08:12 UTC Last updatedMost recent change to the record

Details

Published

2025-01-03 17:15 UTC

Last modified

2026-06-17 08:12 UTC

Exploit probability

0.3% · EPSS, next 30 days

Weakness

CWE-79 · Cross-site scripting

Record status

Analyzed

Affected

• Phpoffice Phpspreadsheet < 1.29.7
• Phpoffice Phpspreadsheet < 2.1.6
• Phpoffice Phpspreadsheet < 2.3.5
• Phpoffice Phpspreadsheet < 3.7.0

Attack profile CVSS 4.0 · 8.3

Attack vector

Network

Complexity

Low

Attack requirements

None

Privileges needed

None

User interaction

Active

Confidentiality

None

Integrity

High

Availability

None