Packagist/phpoffice/phpexcel CVE-2024-56408: high 7.1, EPSS 0.41%

PhpSpreadsheet allows unauthorized Reflected XSS in `Convert-Online.php` file

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-x88g-h956-m5xg#Packagist/phpoffice/phpexcel
• https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-x88g-h956-m5xg
• https://nvd.nist.gov/vuln/detail/CVE-2024-56408
• https://github.com/PHPOffice/PhpSpreadsheet/commit/700a80346be269af668914172bc6f4521982d0b4
• https://github.com/PHPOffice/PhpSpreadsheet/commit/9b9a55c7154daa7cd4095f618933c240508ba3c1
• https://github.com/PHPOffice/PhpSpreadsheet/commit/a50ebfe118b3ae0ddaea1c48ac19dc38692f4abc
• https://github.com/PHPOffice/PhpSpreadsheet/commit/b8fac55aa5cb7a3d514c7308378bb37bb711b25e
• https://github.com/PHPOffice/PhpSpreadsheet

CVE-2024-56408 · published 2025-01-03T16:05:26Z · modified 2026-09-10T03:50:56.511310919Z · JSON