CVE-2026-40296: PHPOffice PhpSpreadsheet XSS in HTML writer via number format bypass

CVE-2026-40296 · Severity: medium · CVSS 5.4 · Published 2026-05-06

PhpSpreadsheet is a library used by web applications to read and write spreadsheet files like Excel. A security flaw in its HTML conversion tool allows an attacker to bypass security filters by using specific cell formatting. If an application converts a malicious user-uploaded spreadsheet into a web page, it could execute unauthorized scripts in the browsers of other users, potentially leading to account hijacking or data theft.

Technologies: phpoffice/phpspreadsheet (Packagist), Phpoffice Phpspreadsheet. Vendors: Packagist, Phpoffice.

Quick answers

Is CVE-2026-40296 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40296 being exploited in the wild.
How severe is CVE-2026-40296?
Medium severity, with a CVSS score of 5.4, published 6 May 2026.
Which products and versions are affected?
phpoffice/phpspreadsheet (Packagist) ECOSYSTEM:introduced=4.0.0,fixed=5.7.0; Phpoffice Phpspreadsheet < 1.30.4, 2.0.0 - 2.1.15, 2.2.0 - 2.4.4, 3.3.0 - 3.10.4, 4.0.0 - 5.6.0.
Is there a fix for CVE-2026-40296?
Yes. phpoffice/phpspreadsheet (Packagist): upgrade to 5.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40296 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-40296?
Check whether you run phpoffice/phpspreadsheet (Packagist) or Phpoffice Phpspreadsheet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • phpoffice/phpspreadsheet (Packagist): upgrade to 5.7.0 or later
    composer require phpoffice/phpspreadsheet:^5.7.0

Technical details

A stored cross-site scripting (XSS) vulnerability exists in PhpSpreadsheet's HTML writer component. The vulnerability is caused by a conditional check in `Writer/Html.php` that only applies `htmlspecialchars()` escaping if the formatted cell data is identical to the original data. By using a custom number format containing the '@' text placeholder with additional literal characters (e.g., ". @"), an attacker can ensure the formatted value differs from the original, bypassing the escaping logic entirely. An attacker can exploit this by uploading a spreadsheet with a malicious XSS payload in a cell and a specific number format; when the library converts this to HTML, the payload is rendered unescaped. This issue is resolved in versions 5.7.0, 3.10.5, 2.4.5, 2.1.16, and 1.30.4.

Affected products

  • PHPOffice PhpSpreadsheet < 1.30.4, 2.0.0 - 2.1.15, 2.2.0 - 2.4.4, 3.3.0 - 3.10.4, 4.0.0 - 5.6.0

Identifiers

  • CVE-2026-40296
  • GHSA-hrmw-qprp-wgmc

Timeline

  • 2026-04-26: advisory: GitHub Security Advisory published by maintainer
  • 2026-05-06: disclosed: CVE-2026-40296 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.