Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2024-45293 is a high-severity Improper Restriction of XML External Entity Reference (CWE-611) vulnerability in Phpoffice Phpspreadsheet. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 15% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and SA-11 (Developer Testing and Evaluation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. CVE-2024-45293 is an XML External Entity (XXE) vulnerability in its XLSX reader that stems from a flawed encoding check inside the toUtf8 function of src/PhpSpreadsheet/Reader/Security/XmlScanner.php. The regex intended to detect the XML encoding declaration only matches encoding="*" or encoding='*'; any whitespace around the equals sign causes the check to fail, defaulting to UTF-8 and allowing a UTF-7 encoded XXE payload to bypass the security scanner.
An unauthenticated attacker who can upload XLSX files to a server that processes them with PHPSpreadsheet can supply a crafted spreadsheet that triggers the XXE and reads arbitrary server files or other sensitive information. The attack requires no user interaction and is exploitable over the network with low attack complexity, corresponding to the CVSS 7.5 rating and CWE-611 classification.
The GitHub Security Advisory GHSA-6hwr-6v2f-3m88 states that the issue has been fixed in PHPSpreadsheet releases 1.29.1, 2.1.1, and 2.3.0 and that no workarounds exist; all users are advised to upgrade immediately.
The EPSS score currently stands at 0.7163, its recorded peak, with no material rise from a low baseline after disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-2967
Vulnerability Data
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The security scanner responsible for preventing XXE attacks in the XLSX reader can be bypassed by slightly modifying the XML structure, utilizing white-spaces. On servers that allow users…
more
to upload their own Excel (XLSX) sheets, Server files and sensitive information can be disclosed by providing a crafted sheet. The security scan function in src/PhpSpreadsheet/Reader/Security/XmlScanner.php contains a flawed XML encoding check to retrieve the input file's XML encoding in the toUtf8 function. The function searches for the XML encoding through a defined regex which looks for `encoding="*"` and/or `encoding='*'`, if not found, it defaults to the UTF-8 encoding which bypasses the conversion logic. This logic can be used to pass a UTF-7 encoded XXE payload, by utilizing a whitespace before or after the = in the attribute definition. Sensitive information disclosure through the XXE on sites that allow users to upload their own excel spreadsheets, and parse them using PHPSpreadsheet's Excel parser. This issue has been addressed in release versions 1.29.1, 2.1.1, and 2.3.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.5.1V15.3.2
Mitigating Controls (NIST 800-53 r5) AI
Secure configuration settings can disable external entity processing in XML parsers.
Developer testing can discover XXE flaws through targeted XML parsing tests.
Input validation can reject or sanitize XML containing external entity references.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Hardened XML parser configurations directly disable external entity resolution.
Secure SDLC practices include input validation and safe XML parser configuration that prevent XXE.
Vulnerability scanning can discover XXE flaws but does not prevent their introduction in code.
Patching eliminates XXE-vulnerable parser versions but is only one aspect of software maintenance.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches XXE via static analysis and dynamic XML fuzzing.
Vulnerability management identifies and patches XML libraries with unsafe default entity settings.
Secure development life cycle mandates input validation and entity handling that directly prevents XXE.
Application security requirements explicitly call for disabling external entity processing in XML parsers.
Secure architecture principles include safe parser configuration that mitigates external entity risks.
Secure coding standards require disabling DTDs and external entities in XML processing.