← Database

CVE-2024-56410

MEDIUM CVSS: 5.4 Published: 2025-01-03 Modified: 2026-06-17

Description

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have a cross-site scripting (XSS) vulnerability in custom properties. The HTML page is generated without clearing custom properties. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.

Affected Platforms

Phpoffice Phpspreadsheet

Weakness Type

CWE-79

References