Later archive addition

PhpSpreadsheet Versions <= 1.5.0 — XXE injection

@bishopfox · Bishop Fox

The advisory describes XML external entity injection in PhpSpreadsheet when parsing attacker-supplied spreadsheet formats. Crafted workbook XML can cause server-side file reads or outbound requests, exposing local data and network resources in applications that treat uploaded spreadsheets as safe documents.

Record

Researcher

@bishopfox

Published by

Bishop Fox

Format

Advisory

In the archive

• Added to the 2018 archive after the original list was published

Tags

• php
• xxe
• file-read
• ssrf
• file-upload
• owasp-a03-2021
• owasp-a10-2021

This page is the archive's own catalogue record. The research is the work of @bishopfox, first published at the original source. Preserved copies are kept so the citation survives its host.