{"action":"Upgrade phpoffice/phpspreadsheet to 1.29.7 or later.","affected":[{"fixed":"3.7.0","introduced":"3.0.0"},{"fixed":"1.29.7","introduced":"0"},{"fixed":"2.1.6","introduced":"2.0.0"},{"fixed":"2.3.5","introduced":"2.2.0"}],"component":"phpoffice/phpspreadsheet","cve_ids":["CVE-2024-56408"],"ecosystem":"Packagist","epss":0.00414,"exploited":false,"fixed_versions":["3.7.0","1.29.7","2.1.6","2.3.5"],"ghsa_id":"GHSA-x88g-h956-m5xg","id":"tcs_01M5KFAV99E3F155P8NF5QNFP5","modified_at":"2026-09-10T03:50:56.511310919Z","published_at":"2025-01-03T16:05:26Z","references":["https://osv.dev/vulnerability/GHSA-x88g-h956-m5xg","https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-x88g-h956-m5xg","https://nvd.nist.gov/vuln/detail/CVE-2024-56408","https://github.com/PHPOffice/PhpSpreadsheet/commit/700a80346be269af668914172bc6f4521982d0b4","https://github.com/PHPOffice/PhpSpreadsheet/commit/9b9a55c7154daa7cd4095f618933c240508ba3c1","https://github.com/PHPOffice/PhpSpreadsheet/commit/a50ebfe118b3ae0ddaea1c48ac19dc38692f4abc","https://github.com/PHPOffice/PhpSpreadsheet/commit/b8fac55aa5cb7a3d514c7308378bb37bb711b25e","https://github.com/PHPOffice/PhpSpreadsheet"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-x88g-h956-m5xg","url":"https://osv.dev/vulnerability/GHSA-x88g-h956-m5xg"}],"summary":"PhpSpreadsheet allows unauthorized Reflected XSS in `Convert-Online.php` file"}