CVE-2026-40296

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40296", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-10T20:22:44.035Z", "datePublished": "2026-05-06T20:48:34.504Z", "dateUpdated": "2026-05-07T14:03:36.388Z"}, "containers": {"cna": {"title": "PhpSpreadsheet vulnerable to XSS in HTML writer via custom number format codes", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-hrmw-qprp-wgmc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-hrmw-qprp-wgmc"}], "affected": [{"vendor": "PHPOffice", "product": "PhpSpreadsheet", "versions": [{"version": ">= 4.0.0, <= 5.6.0", "status": "affected"}, {"version": ">= 3.3.0, <= 3.10.4", "status": "affected"}, {"version": ">= 2.2.0, <= 2.4.4", "status": "affected"}, {"version": ">= 2.0.0, <= 2.1.15", "status": "affected"}, {"version": "<= 1.30.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-06T20:48:34.504Z"}, "descriptions": [{"lang": "en", "value": "PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The HTML writer skips htmlspecialchars escaping when a cell's formatted value differs from the original value. When a cell has a custom number format containing the text placeholder @ along with any additional literal characters (for example \". @\", \"@ \", or \"x@\"), the formatter replaces @ with the cell value and adds the extra characters, causing the formatted value to differ from the original and bypassing HTML escaping entirely. An attacker who can control the cell value and number format of an uploaded spreadsheet that is later converted to HTML and displayed to other users can achieve stored cross-site scripting. This issue is fixed in versions 5.7.0, 3.10.5, 2.4.5, 2.1.16, and 1.30.4."}], "source": {"advisory": "GHSA-hrmw-qprp-wgmc", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-hrmw-qprp-wgmc", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-07T14:02:42.632553Z", "id": "CVE-2026-40296", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-07T14:03:36.388Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40296", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-07T14:02:42.632553Z"}}}], "references": [{"url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-hrmw-qprp-wgmc", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-07T14:03:32.309Z"}}], "cna": {"title": "PhpSpreadsheet vulnerable to XSS in HTML writer via custom number format codes", "source": {"advisory": "GHSA-hrmw-qprp-wgmc", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "PHPOffice", "product": "PhpSpreadsheet", "versions": [{"status": "affected", "version": ">= 4.0.0, <= 5.6.0"}, {"status": "affected", "version": ">= 3.3.0, <= 3.10.4"}, {"status": "affected", "version": ">= 2.2.0, <= 2.4.4"}, {"status": "affected", "version": ">= 2.0.0, <= 2.1.15"}, {"status": "affected", "version": "<= 1.30.3"}]}], "references": [{"url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-hrmw-qprp-wgmc", "name": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-hrmw-qprp-wgmc", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The HTML writer skips htmlspecialchars escaping when a cell's formatted value differs from the original value. When a cell has a custom number format containing the text placeholder @ along with any additional literal characters (for example \". @\", \"@ \", or \"x@\"), the formatter replaces @ with the cell value and adds the extra characters, causing the formatted value to differ from the original and bypassing HTML escaping entirely. An attacker who can control the cell value and number format of an uploaded spreadsheet that is later converted to HTML and displayed to other users can achieve stored cross-site scripting. This issue is fixed in versions 5.7.0, 3.10.5, 2.4.5, 2.1.16, and 1.30.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-06T20:48:34.504Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40296", "state": "PUBLISHED", "dateUpdated": "2026-05-07T14:03:36.388Z", "dateReserved": "2026-04-10T20:22:44.035Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-06T20:48:34.504Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "PhpSpreadsheet", "vendor": "PHPOffice", "versions": [{"status": "affected", "version": ">= 4.0.0, <= 5.6.0"}, {"status": "affected", "version": ">= 3.3.0, <= 3.10.4"}, {"status": "affected", "version": ">= 2.2.0, <= 2.4.4"}, {"status": "affected", "version": ">= 2.0.0, <= 2.1.15"}, {"status": "affected", "version": "<= 1.30.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*", "matchCriteriaId": "21F2C6F6-C903-4A65-BCB4-4549FE752ED5", "versionEndExcluding": "1.30.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*", "matchCriteriaId": "E27B01CE-562C-4746-A7F5-E402B25F0B47", "versionEndExcluding": "2.1.16", "versionStartIncluding": "2.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*", "matchCriteriaId": "46FF2D5E-816F-481B-AA45-41BA6EDCFEA0", "versionEndExcluding": "2.4.5", "versionStartIncluding": "2.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*", "matchCriteriaId": "DF58DF5C-8F1B-4B1B-80A0-001B47751D9F", "versionEndExcluding": "3.10.5", "versionStartIncluding": "3.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*", "matchCriteriaId": "DD7DEDE3-C624-4524-9B08-08B92F28C40C", "versionEndExcluding": "5.7.0", "versionStartIncluding": "4.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The HTML writer skips htmlspecialchars escaping when a cell's formatted value differs from the original value. When a cell has a custom number format containing the text placeholder @ along with any additional literal characters (for example \". @\", \"@ \", or \"x@\"), the formatter replaces @ with the cell value and adds the extra characters, causing the formatted value to differ from the original and bypassing HTML escaping entirely. An attacker who can control the cell value and number format of an uploaded spreadsheet that is later converted to HTML and displayed to other users can achieve stored cross-site scripting. This issue is fixed in versions 5.7.0, 3.10.5, 2.4.5, 2.1.16, and 1.30.4."}, {"lang": "es", "value": "PhpSpreadsheet es una biblioteca PHP pura para leer y escribir archivos de hoja de c\u00e1lculo. El escritor HTML omite el escape de htmlspecialchars cuando el valor formateado de una celda difiere del valor original. Cuando una celda tiene un formato de n\u00famero personalizado que contiene el marcador de posici\u00f3n de texto @ junto con cualquier car\u00e1cter literal adicional (por ejemplo, \u2019. @\u2019, \u2019@ \u2019, o \u2019x@\u2019), el formateador reemplaza @ con el valor de la celda y a\u00f1ade los caracteres adicionales, haciendo que el valor formateado difiera del original y omitiendo completamente el escape HTML. Un atacante que puede controlar el valor de la celda y el formato de n\u00famero de una hoja de c\u00e1lculo cargada que luego se convierte a HTML y se muestra a otros usuarios puede lograr cross-site scripting almacenado. Este problema est\u00e1 solucionado en las versiones 5.7.0, 3.10.5, 2.4.5, 2.1.16 y 1.30.4."}], "id": "CVE-2026-40296", "lastModified": "2026-10-26T19:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40296", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-07T14:02:42.632553Z", "version": "2.0.3"}}]}, "published": "2026-05-06T22:16:25.510", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-hrmw-qprp-wgmc"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-hrmw-qprp-wgmc"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,5.6.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.3.0,3.10.4]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.2.0,2.4.4]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,2.1.15]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.30.3]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "PhpSpreadsheet", "source": "cna", "vendor": "PHPOffice"}, "product": "phpspreadsheet", "vendor": "phpoffice"}], "created": "2026-05-06T22:30:13.702807+00:00", "updated": "2026-05-06T22:45:13.564343+00:00", "vendors": ["phpoffice", "phpoffice$PRODUCT$phpspreadsheet"]}