CVE-2018-19277: Phpoffice Phpspreadsheet

High severity, CVSS 8.8. EPSS: 7.8% chance of exploitation in the next 30 days.

securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file

Affected products

• Phpoffice Phpspreadsheet: up to and including 1.5.0

Published 2018-11-14. Last modified 2026-06-17.