{"action":"Upgrade phpoffice/phpspreadsheet to 1.5.1 or later.","affected":[{"fixed":"1.5.1","introduced":"0"}],"component":"phpoffice/phpspreadsheet","cve_ids":["CVE-2018-19277"],"ecosystem":"Packagist","epss":0.07791,"exploited":false,"fixed_versions":["1.5.1"],"ghsa_id":"GHSA-xcrg-29h7-h4cj","id":"tcs_01M5KFAYXYCSHD7NE03FCFHJVK","modified_at":"2025-03-06T18:38:20.246894Z","published_at":"2019-11-20T01:38:52Z","references":["https://osv.dev/vulnerability/GHSA-xcrg-29h7-h4cj","https://nvd.nist.gov/vuln/detail/CVE-2018-19277","https://github.com/MewesK/TwigSpreadsheetBundle/issues/18","https://github.com/PHPOffice/PhpSpreadsheet/issues/771","https://github.com/PHPOffice/PhpSpreadsheet/pull/780","https://github.com/PHPOffice/PHPExcel/commit/2b601574975acfb9d4378a788ed5f2b747958095","https://github.com/PHPOffice/PhpSpreadsheet/commit/0f8f071e24ee8b114d894ac172f77dc250e5bfa4","https://github.com/FriendsOfPHP/security-advisories/blob/master/phpoffice/phpspreadsheet/CVE-2018-19277.yaml","https://github.com/PHPOffice/PHPExcel/commits/1.8.2","https://github.com/PHPOffice/PhpSpreadsheet","https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.5.1","https://www.bishopfox.com/news/2018/11/phpoffice-versions","https://www.drupal.org/sa-contrib-2021-043"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-xcrg-29h7-h4cj","url":"https://osv.dev/vulnerability/GHSA-xcrg-29h7-h4cj"}],"summary":"XXE in PHPSpreadsheet due to encoding issue"}