Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-40296

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The HTML writer skips htmlspecialchars escaping when a cell's formatted value differs from the original value. When a cell has a custom number format containing the text placeholder @ along with any additional literal characters (for example ". @", "@ ", or "x@"), the formatter replaces @ with the cell value and adds the extra characters, causing the formatted value to differ from the original and bypassing HTML esca
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:22561a9db5f2c0f539b436b20cab639af22d677af46d8ce2fa784ebad34740ca
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"product":"PhpSpreadsheet","vendor":"PHPOffice","versions":[{"status":"affected","version":">= 4.0.0, <= 5.6.0"},{"status":"affected","version":">= 3.3.0, <= 3.10.4"},{"status":"affected","version":">= 2.2.0, <= 2.4.4"},{"status":"affected","version":">= 2.0.0, <= 2.1.15"},{"status":"affected","version":"<= 1.30.3"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:5c254c928e00282be87f2dde83a585cc6b6fc00a30ee182d1fb73ccf1fc38e7e · sha256:b3079dca842d9711… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:5c254c928e00282be87f2dde83a585cc6b6fc00a30ee182d1fb73ccf1fc38e7e · sha256:b3079dca842d9711… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-79","description":"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:5c254c928e00282be87f2dde83a585cc6b6fc00a30ee182d1fb73ccf1fc38e7e · sha256:b3079dca842d9711… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions
{"tags":["exploit"],"url":"https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-hrmw-qprp-wgmc"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:5c254c928e00282be87f2dde83a585cc6b6fc00a30ee182d1fb73ccf1fc38e7e · sha256:b3079dca842d9711… · /containers/adp/0/references/0
{"name":"https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-hrmw-qprp-wgmc","tags":["x_refsource_CONFIRM"],"url":"https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-hrmw-qprp-wgmc"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:5c254c928e00282be87f2dde83a585cc6b6fc00a30ee182d1fb73ccf1fc38e7e · sha256:b3079dca842d9711… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer