CVE-2026-40296 Details
Description
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The HTML writer skips htmlspecialchars escaping when a cell's formatted value differs from the original value. When a cell has a custom number format containing the text placeholder @ along with any additional literal characters (for example ". @", "@ ", or "x@"), the formatter replaces @ with the cell value and adds the extra characters, causing the formatted value to differ from the original and bypassing HTML escaping entirely. An attacker who can control the cell value and number format of an uploaded spreadsheet that is later converted to HTML and displayed to other users can achieve stored cross-site scripting. This issue is fixed in versions 5.7.0, 3.10.5, 2.4.5, 2.1.16, and 1.30.4.
A stored cross-site scripting vulnerability has been identified in PhpSpreadsheet versions 4.0.0 through 5.6.0, 3.3.0 through 3.10.4, 2.2.0 through 2.4.4, 2.0.0 through 2.1.15, and 1.30.3 and prior. The issue arises in the HTML writer component, where the library fails to properly escape HTML characters in certain scenarios. Specifically, when a cell's custom number format includes the text placeholder '@' along with additional literal characters, the formatter replaces the '@' with the cell value and appends the extra characters. This alteration causes the formatted value to diverge from the original, allowing an attacker to inject malicious content that is not escaped when the spreadsheet is converted to HTML and displayed to users.
Users can upgrade to PhpSpreadsheet versions 5.7.0, 3.10.5, 2.4.5, 2.1.16, or 1.30.4 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-hrmw-qprp-wgmc | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-hrmw-qprp-wgmc | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| phpoffice phpspreadsheet | < 1.30.4 >= 2.0.0, < 2.1.16 >= 2.2.0, < 2.4.5 >= 3.3.0, < 3.10.5 >= 4.0.0, < 5.7.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | Initial Analysis | [email protected] |
| May 7, 2026 | CVE Modified | CISA-ADP |
| May 6, 2026 | New CVE Received | [email protected] |