Packagist/phpoffice/phpspreadsheet CVE-2020-7776: medium 6.4, EPSS 1.32%

Cross-site scripting in phpoffice/phpspreadsheet

Action: Upgrade phpoffice/phpspreadsheet to 1.16.0 or later.

composer require phpoffice/phpspreadsheet:1.16.0

Affected

Fixed versions

Sources

• osv: GHSA-4mqv-gcr3-pff9
• https://nvd.nist.gov/vuln/detail/CVE-2020-7776
• https://github.com/PHPOffice/PhpSpreadsheet/pull/1719
• https://github.com/PHPOffice/PhpSpreadsheet/commit/0ed5b800be2136bcb8fa9c1bdf59abc957a98845
• https://github.com/FriendsOfPHP/security-advisories/blob/master/phpoffice/phpspreadsheet/CVE-2020-7776.yaml
• https://github.com/PHPOffice/PhpSpreadsheet/blob/master/src/PhpSpreadsheet/Writer/Html.php%23L1792
• https://snyk.io/vuln/SNYK-PHP-PHPOFFICEPHPSPREADSHEET-1048856

CVE-2020-7776 · published 2021-05-06T18:53:37Z · modified 2026-07-08T06:49:43.508214068Z · JSON