CVE-2026-35453: PHPOffice PhpSpreadsheet XSS in HTML Writer via NumberFormat

CVE-2026-35453 · Severity: medium · CVSS 5.4 · Published 2026-05-05

PhpSpreadsheet is a popular software library used by web applications to read and generate spreadsheet files like Excel. A security flaw in its HTML export feature allows an attacker to embed malicious scripts within a spreadsheet. If a user views the resulting HTML page generated by the library, the attacker could steal session information or perform unauthorized actions on the user's behalf.

Technologies: phpoffice/phpspreadsheet (Packagist), Phpoffice Phpspreadsheet. Vendors: Packagist, Phpoffice.

Quick answers

Is CVE-2026-35453 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-35453 being exploited in the wild.
How severe is CVE-2026-35453?
Medium severity, with a CVSS score of 5.4, published 5 May 2026.
Which products and versions are affected?
phpoffice/phpspreadsheet (Packagist) ECOSYSTEM:introduced=4.0.0,fixed=5.7.0; Phpoffice Phpspreadsheet <= 1.30.3, 2.0.0 - 2.1.15, 2.2.0 - 2.4.4, 3.3.0 - 3.10.4, 4.0.0 - 5.6.0.
Is there a fix for CVE-2026-35453?
Yes. phpoffice/phpspreadsheet (Packagist): upgrade to 5.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35453 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-35453?
Check whether you run phpoffice/phpspreadsheet (Packagist) or Phpoffice Phpspreadsheet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • phpoffice/phpspreadsheet (Packagist): upgrade to 5.7.0 or later
    composer require phpoffice/phpspreadsheet:^5.7.0

Technical details

A cross-site scripting (XSS) vulnerability exists in the PhpSpreadsheet HTML Writer. The root cause is a failure to apply htmlspecialchars() escaping when a cell uses a custom number format containing the '@' text placeholder combined with literal text (e.g., '@ "items"'). In these cases, the formatter substitutes the raw cell value into the format string and returns early, bypassing the escaping callback. An attacker with the ability to control cell content can inject arbitrary HTML and JavaScript into the generated output. The issue is fixed in versions 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0.

Affected products

  • PHPOffice PhpSpreadsheet <= 1.30.3, 2.0.0 - 2.1.15, 2.2.0 - 2.4.4, 3.3.0 - 3.10.4, 4.0.0 - 5.6.0

Identifiers

  • CVE-2026-35453
  • GHSA-6wpp-88cp-7q68

Timeline

  • 2026-04-26: advisory: GitHub Advisory GHSA-6wpp-88cp-7q68 published
  • 2026-05-05: disclosed: CVE-2026-35453 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.