# CVE-2026-40296: PHPOffice PhpSpreadsheet XSS in HTML writer via number format bypass

Source: https://junglewise.ai/threats/cve-2026-40296-phpoffice-phpspreadsheet-xss-in-html-writer-via-number-format  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-06. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-40296 · Severity: medium · CVSS 5.4 · Published 2026-05-06

PhpSpreadsheet is a library used by web applications to read and write spreadsheet files like Excel. A security flaw in its HTML conversion tool allows an attacker to bypass security filters by using specific cell formatting. If an application converts a malicious user-uploaded spreadsheet into a web page, it could execute unauthorized scripts in the browsers of other users, potentially leading to account hijacking or data theft.

Technologies: [phpoffice/phpspreadsheet (Packagist)](https://junglewise.ai/threats/technologies/phpoffice-phpspreadsheet), [Phpoffice Phpspreadsheet](https://junglewise.ai/threats/technologies/phpspreadsheet). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Phpoffice](https://junglewise.ai/threats/vendors/phpoffice).

## Quick answers

**Is CVE-2026-40296 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40296 being exploited in the wild.

**How severe is CVE-2026-40296?** Medium severity, with a CVSS score of 5.4, published 6 May 2026.

**Which products and versions are affected?** phpoffice/phpspreadsheet (Packagist) ECOSYSTEM:introduced=4.0.0,fixed=5.7.0; Phpoffice Phpspreadsheet < 1.30.4, 2.0.0 - 2.1.15, 2.2.0 - 2.4.4, 3.3.0 - 3.10.4, 4.0.0 - 5.6.0.

**Is there a fix for CVE-2026-40296?** Yes. phpoffice/phpspreadsheet (Packagist): upgrade to 5.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40296 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-40296?** Check whether you run phpoffice/phpspreadsheet (Packagist) or Phpoffice Phpspreadsheet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- phpoffice/phpspreadsheet (Packagist): upgrade to 5.7.0 or later

  ```sh
  composer require phpoffice/phpspreadsheet:^5.7.0
  ```


## Technical details

A stored cross-site scripting (XSS) vulnerability exists in PhpSpreadsheet's HTML writer component. The vulnerability is caused by a conditional check in `Writer/Html.php` that only applies `htmlspecialchars()` escaping if the formatted cell data is identical to the original data. By using a custom number format containing the '@' text placeholder with additional literal characters (e.g., ". @"), an attacker can ensure the formatted value differs from the original, bypassing the escaping logic entirely. An attacker can exploit this by uploading a spreadsheet with a malicious XSS payload in a cell and a specific number format; when the library converts this to HTML, the payload is rendered unescaped. This issue is resolved in versions 5.7.0, 3.10.5, 2.4.5, 2.1.16, and 1.30.4.

## Affected products

- PHPOffice PhpSpreadsheet < 1.30.4, 2.0.0 - 2.1.15, 2.2.0 - 2.4.4, 3.3.0 - 3.10.4, 4.0.0 - 5.6.0

## Identifiers

- CVE-2026-40296
- GHSA-hrmw-qprp-wgmc

## Timeline

- 2026-04-26: advisory: GitHub Security Advisory published by maintainer
- 2026-05-06: disclosed: CVE-2026-40296 published

## References

- [https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-hrmw-qprp-wgmc](https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-hrmw-qprp-wgmc)

## Related threats

- [PHPOffice PhpSpreadsheet redirect validation bypass in external image loading](https://junglewise.ai/threats/cve-2026-108360-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing)
- [PhpSpreadsheet denial-of-service via unbounded row repetition](https://junglewise.ai/threats/cve-2026-108359-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing)
- [PhpSpreadsheet XmlScanner XML entity expansion denial of service](https://junglewise.ai/threats/cve-2026-108358-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing)
- [PHPOffice PhpSpreadsheet XML entity expansion denial of service](https://junglewise.ai/threats/cve-2026-108357-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing)
- [MediaWiki DataTransfer Extension uncontrolled resource consumption](https://junglewise.ai/threats/cve-2026-100242-dependency-on-vulnerable-third-party-component-and-uncontrolled)