# CVE-2026-35453: PHPOffice PhpSpreadsheet XSS in HTML Writer via NumberFormat

Source: https://junglewise.ai/threats/cve-2026-35453-phpoffice-phpspreadsheet-xss-in-html-writer-via-numberformat  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-05. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-35453 · Severity: medium · CVSS 5.4 · Published 2026-05-05

PhpSpreadsheet is a popular software library used by web applications to read and generate spreadsheet files like Excel. A security flaw in its HTML export feature allows an attacker to embed malicious scripts within a spreadsheet. If a user views the resulting HTML page generated by the library, the attacker could steal session information or perform unauthorized actions on the user's behalf.

Technologies: [phpoffice/phpspreadsheet (Packagist)](https://junglewise.ai/threats/technologies/phpoffice-phpspreadsheet), [Phpoffice Phpspreadsheet](https://junglewise.ai/threats/technologies/phpspreadsheet). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Phpoffice](https://junglewise.ai/threats/vendors/phpoffice).

## Quick answers

**Is CVE-2026-35453 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35453 being exploited in the wild.

**How severe is CVE-2026-35453?** Medium severity, with a CVSS score of 5.4, published 5 May 2026.

**Which products and versions are affected?** phpoffice/phpspreadsheet (Packagist) ECOSYSTEM:introduced=4.0.0,fixed=5.7.0; Phpoffice Phpspreadsheet <= 1.30.3, 2.0.0 - 2.1.15, 2.2.0 - 2.4.4, 3.3.0 - 3.10.4, 4.0.0 - 5.6.0.

**Is there a fix for CVE-2026-35453?** Yes. phpoffice/phpspreadsheet (Packagist): upgrade to 5.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-35453 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-35453?** Check whether you run phpoffice/phpspreadsheet (Packagist) or Phpoffice Phpspreadsheet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- phpoffice/phpspreadsheet (Packagist): upgrade to 5.7.0 or later

  ```sh
  composer require phpoffice/phpspreadsheet:^5.7.0
  ```


## Technical details

A cross-site scripting (XSS) vulnerability exists in the PhpSpreadsheet HTML Writer. The root cause is a failure to apply htmlspecialchars() escaping when a cell uses a custom number format containing the '@' text placeholder combined with literal text (e.g., '@ "items"'). In these cases, the formatter substitutes the raw cell value into the format string and returns early, bypassing the escaping callback. An attacker with the ability to control cell content can inject arbitrary HTML and JavaScript into the generated output. The issue is fixed in versions 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0.

## Affected products

- PHPOffice PhpSpreadsheet <= 1.30.3, 2.0.0 - 2.1.15, 2.2.0 - 2.4.4, 3.3.0 - 3.10.4, 4.0.0 - 5.6.0

## Identifiers

- CVE-2026-35453
- GHSA-6wpp-88cp-7q68

## Timeline

- 2026-04-26: advisory: GitHub Advisory GHSA-6wpp-88cp-7q68 published
- 2026-05-05: disclosed: CVE-2026-35453 published

## References

- [https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6wpp-88cp-7q68](https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6wpp-88cp-7q68)

## Related threats

- [PHPOffice PhpSpreadsheet redirect validation bypass in external image loading](https://junglewise.ai/threats/cve-2026-108360-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing)
- [PhpSpreadsheet denial-of-service via unbounded row repetition](https://junglewise.ai/threats/cve-2026-108359-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing)
- [PhpSpreadsheet XmlScanner XML entity expansion denial of service](https://junglewise.ai/threats/cve-2026-108358-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing)
- [PHPOffice PhpSpreadsheet XML entity expansion denial of service](https://junglewise.ai/threats/cve-2026-108357-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing)
- [MediaWiki DataTransfer Extension uncontrolled resource consumption](https://junglewise.ai/threats/cve-2026-100242-dependency-on-vulnerable-third-party-component-and-uncontrolled)