CVE-2019-12331: XEE
PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared in the header. This was a security measurement to prevent CVE-2018-19277 but the fix is not sufficient. By double-encoding the the xml payload to utf-7 it is possible to bypass the check for the string ?<!ENTITY? and thus allowing for an xml external entity processing (XXE) attack.
Other sources
PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared in the header. This was a security measurement to prevent CVE-2018-19277 but the fix is not sufficient. By double-encoding the the xml payload to utf-7 it is possible to bypass the check for the string ‚<!ENTITY‘ and thus allowing for an xml external entity processing (XXE) attack.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-12331?
CVE-2019-12331 is an XXE vulnerability in PHPOffice PhpSpreadsheet before version 1.8.0.
How severe is CVE-2019-12331?
CVE-2019-12331 has a severity rating of 8.8 (High).
What is affected by CVE-2019-12331?
PHPOffice PhpSpreadsheet versions before 1.8.0 are affected by CVE-2019-12331.
How can CVE-2019-12331 be fixed?
To fix CVE-2019-12331, update PHPOffice PhpSpreadsheet to version 1.8.0 or later.
Where can I find more information about CVE-2019-12331?
More information about CVE-2019-12331 can be found at the following references: [GitHub Pull Request](https://github.com/PHPOffice/PhpSpreadsheet/pull/1041), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2019-12331), [CHANGELOG.md](https://github.com/PHPOffice/PhpSpreadsheet/blob/master/CHANGELOG.md#180---2019-07-01).