What is CVE-2024-45048?

CVE-2024-45048 is a high-severity vulnerability in Phpoffice Phpspreadsheet, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 8.8/10. Published 2024-08-28.

How severe is CVE-2024-45048?

High severity. CVSS v3 base score is 8.8 out of 10.

XXE in Phpoffice Phpspreadsheet

CVE-2024-45048

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions are subject to a bypassing of a filter which allows for an XXE-attack. This in turn allows attacker to obtain contents of local files, even if error reporting is muted. This vulnerability has been addressed in release version 2.2.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Vulnerability class: XXE (XML External Entity)

EPSS: 0.006 (47.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Phpoffice Phpspreadsheet — versions < 2.2.1

Weakness classification (CWE)

CWE-611 — Improper Restriction of XML External Entity Reference (XXE)

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Third Party Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2024-45048?: CVE-2024-45048 is a high-severity vulnerability in Phpoffice Phpspreadsheet, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 8.8/10. Published 2024-08-28.
How severe is CVE-2024-45048?: High severity. CVSS v3 base score is 8.8 out of 10.