What’s Vulnerable › Vulnerabilities

CVE-2018-19277

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 7.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-11-14 · updated 2026-06-17
• Weakness: CWE-91

Description

securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file

Affected products

• PHPOffice PhpSpreadsheet: through 1.5.0

References

• https://github.com/MewesK/TwigSpreadsheetBundle/issues/18
• https://github.com/PHPOffice/PhpSpreadsheet/issues/771
• https://www.bishopfox.com/news/2018/11/phpoffice-versions/
• https://www.drupal.org/sa-contrib-2021-043
• https://github.com/MewesK/TwigSpreadsheetBundle/issues/18
• https://github.com/PHPOffice/PhpSpreadsheet/issues/771
• https://www.bishopfox.com/news/2018/11/phpoffice-versions/
• https://www.drupal.org/sa-contrib-2021-043

Get alerted when CVE-2018-19277 or the next vulnerability affects your stack