high CVSS 7.5

CVE-2024-45293·PHP vulnerability

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The security scanner responsible for preventing XXE attacks in the XLSX reader can be bypassed by slightly modifying the XML structure, utilizing white-spaces. On servers that allow users to upload their own Excel (XLSX) sheets, Server files and sensitive information can be disclosed by providing a crafted sheet. The security scan function in src/PhpSpreadsheet/Reader/Security/XmlScanner.php contains a flawed XML encoding check to retrieve the input file's XML encoding in the toUtf8 function. The function searches for the XML encoding through a defined regex which looks for `encoding="*"` and/or `encoding='*'`, if not found, it defaults to the UTF-8 encoding which bypasses the conversion logic. This logic can be used to pass a UTF-7 encoded XXE payload, by utilizing a whitespace before or after the = in the attribute definition. Sensitive information disclosure through the XXE on sites that allow users to upload their own excel spreadsheets, and parse them using PHPSpreadsheet's Excel parser. This issue has been addressed in release versions 1.29.1, 2.1.1, and 2.3.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Severity
high
Software
PHP
Fixed in
2.3.0
Published
2024-10-07

Affected versions

From: 2.2.0

Until: 2.3.0

Fixed in: 2.3.0

How to fix this CVE

Update PHPSpreadsheet to version 2.3.0 or later to patch the XML encoding bypass vulnerability that allows XXE attacks through specially crafted XLSX files. If your application uses PHPSpreadsheet for processing user-uploaded Excel files, prioritize this update immediately as attackers can extract sensitive server files and configuration data. Verify the library version in your composer.lock or vendor directory and run composer update to pull the patched release.

sudo dnf update php php-cli php-common

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST requests uploading .xlsx files with XML declaration containing encoding attribute with whitespace before or after the equals sign (e.g., encoding = "UTF-7"|encoding= 'UTF-7') followed by XXE payload markup

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch. 

Block XLSX file uploads containing XML encoding declarations with non-standard whitespace patterns. Implement content-type validation for Excel uploads and restrict processing to known-safe versions of PHPSpreadsheet via application-level version pinning.

How to check if you are affected

  1. Check PHPSpreadsheet version: grep -r '"version"' vendor/phpoffice/phpspreadsheet/composer.json or composer show phpoffice/phpspreadsheet
  2. Verify if your application accepts user-uploaded XLSX files by searching the codebase for PHPSpreadsheet Reader instantiation: grep -r 'IOFactory::load\|Xlsx' src/
  3. Review web server logs for suspicious XLSX upload requests with unusual encoding attributes: grep -i 'xlsx\|spreadsheet' /var/log/apache2/access.log | grep -i 'post'
  4. Confirm the fix by re-running composer show phpoffice/phpspreadsheet and verifying the version is 2.3.0 or later, then restart PHP-FPM: sudo systemctl restart php-fpm

Indicators of compromise

  • XLSX files with XML encoding declarations using whitespace around the = character
  • POST requests to file upload endpoints with Content-Type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet containing XXE payloads

FAQ

What is CVE-2024-45293?

CVE-2024-45293 is an XML External Entity (XXE) injection vulnerability in PHPSpreadsheet's XLSX parser that can be triggered by manipulating XML encoding declarations with whitespace characters. An attacker can bypass the built-in XXE security scanner and read sensitive files from the server by uploading a maliciously crafted Excel spreadsheet.

Is CVE-2024-45293 being actively exploited?

No, CVE-2024-45293 is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and no public exploits have been disclosed, though the vulnerability is trivial to exploit on unpatched systems.

What versions of PHP are affected by CVE-2024-45293?

CVE-2024-45293 affects PHPSpreadsheet versions 2.2.0 through 2.3.0 (exclusive). The vulnerability has been patched in version 2.3.0 and earlier supported branches 1.29.1 and 2.1.1.

How do I check if my server is vulnerable to CVE-2024-45293?

Run: composer show phpoffice/phpspreadsheet | grep Version; if the version is between 2.2.0 and 2.2.x, your server is vulnerable. Additionally, check if your application processes user-uploaded XLSX files by searching your codebase for Xlsx reader usage.

Does Defensia detect CVE-2024-45293?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If PHPSpreadsheet is installed on a monitored server, CVE-2024-45293 will appear in your dashboard with remediation steps.

Related PHP CVEs

CVE-2026-28289CVSS 10FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A patch bypass vulnerability for CVE-2026-27636 in FreeScout 1.8.206 and earlier allows any authenticated user with file upload permissions to achieve Remote Code Execution (RCE) on the server by uploading a malicious .htaccess file using a zero-width space character prefix to bypass the security check. The vulnerability exists in the sanitizeUploadedFileName() function in app/Http/Helper.php. The function contains a Time-of-Check to Time-of-Use (TOCTOU) flaw where the dot-prefix check occurs before sanitization removes invisible characters. This vulnerability is fixed in 1.8.207.
CVE-2025-47916CVSS 10Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (file: /applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content parameter to the Theme::makeProcessFunction() method; hence it is evaluated by the template engine. Accordingly, this can be exploited by unauthenticated attackers to inject and execute arbitrary PHP code by providing crafted template strings.
CVE-2024-5932CVSS 10The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely, and to delete arbitrary files.
CVE-2025-25174CVSS 10Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in beeteam368 BeeTeam368 Extensions beeteam368-extensions allows PHP Local File Inclusion.This issue affects BeeTeam368 Extensions: from n/a through <= 1.9.4.
CVE-2025-46348CVSS 10YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the request to commence a site backup can be performed and downloaded without authentication. The archives are created with a predictable filename, so a malicious user could create and download an archive without being authenticated. This could result in a malicious attacker making numerous requests to create archives and fill up the file system, or by downloading the archive which contains sensitive site information. This issue has been patched in version 4.5.4.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2024-45293. Free for 1 server.

Get started free