CVE-2026-40296

{
  "id": "CVE-2026-40296",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-06T22:16:25.510",
  "lastModified": "2026-10-26T19:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The HTML writer skips htmlspecialchars escaping when a cell's formatted value differs from the original value. When a cell has a custom number format containing the text placeholder @ along with any additional literal characters (for example \". @\", \"@ \", or \"x@\"), the formatter replaces @ with the cell value and adds the extra characters, causing the formatted value to differ from the original and bypassing HTML escaping entirely. An attacker who can control the cell value and number format of an uploaded spreadsheet that is later converted to HTML and displayed to other users can achieve stored cross-site scripting. This issue is fixed in versions 5.7.0, 3.10.5, 2.4.5, 2.1.16, and 1.30.4."
    },
    {
      "lang": "es",
      "value": "PhpSpreadsheet es una biblioteca PHP pura para leer y escribir archivos de hoja de cálculo. El escritor HTML omite el escape de htmlspecialchars cuando el valor formateado de una celda difiere del valor original. Cuando una celda tiene un formato de número personalizado que contiene el marcador de posición de texto @ junto con cualquier carácter literal adicional (por ejemplo, ’. @’, ’@ ’, o ’x@’), el formateador reemplaza @ con el valor de la celda y añade los caracteres adicionales, haciendo que el valor formateado difiera del original y omitiendo completamente el escape HTML. Un atacante que puede controlar el valor de la celda y el formato de número de una hoja de cálculo cargada que luego se convierte a HTML y se muestra a otros usuarios puede lograr cross-site scripting almacenado. Este problema está solucionado en las versiones 5.7.0, 3.10.5, 2.4.5, 2.1.16 y 1.30.4."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "PHPOffice",
          "product": "PhpSpreadsheet",
          "versions": [
            {
              "version": ">= 4.0.0, <= 5.6.0",
              "status": "affected"
            },
            {
              "version": ">= 3.3.0, <= 3.10.4",
              "status": "affected"
            },
            {
              "version": ">= 2.2.0, <= 2.4.4",
              "status": "affected"
            },
            {
              "version": ">= 2.0.0, <= 2.1.15",
              "status": "affected"
            },
            {
              "version": "<= 1.30.3",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-07T14:02:42.632553Z",
          "id": "CVE-2026-40296",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "1.30.4",
              "matchCriteriaId": "21F2C6F6-C903-4A65-BCB4-4549FE752ED5"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.0.0",
              "versionEndExcluding": "2.1.16",
              "matchCriteriaId": "E27B01CE-562C-4746-A7F5-E402B25F0B47"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.2.0",
              "versionEndExcluding": "2.4.5",
              "matchCriteriaId": "46FF2D5E-816F-481B-AA45-41BA6EDCFEA0"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "3.3.0",
              "versionEndExcluding": "3.10.5",
              "matchCriteriaId": "DF58DF5C-8F1B-4B1B-80A0-001B47751D9F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.0.0",
              "versionEndExcluding": "5.7.0",
              "matchCriteriaId": "DD7DEDE3-C624-4524-9B08-08B92F28C40C"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-hrmw-qprp-wgmc",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-hrmw-qprp-wgmc",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}