CVE-2025-22131

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-22131
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-22131.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-22131
Aliases
Published
2025-01-20T15:31:19.693Z
Modified
2026-07-15T01:49:07.124494149Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Cross-Site Scripting (XSS) vulnerability in generateNavigation() function
Details

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Cross-Site Scripting (XSS) vulnerability in the code which translates the XLSX file into a HTML representation and displays it in the response.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/22xxx/CVE-2025-22131.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/phpoffice/phpspreadsheet

Affected ranges

Type
GIT
Repo
https://github.com/phpoffice/phpspreadsheet
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
089ffdfc04b5fcf25a3503d81a4e589f247e20e3
Fixed
949c799c3538f3158bcf6c5f4d8a403027be0fbd
Introduced
4a77798f835119754961a97714f135826a323caa
Fixed
6e5bbcd045708b867f24bea276fb5ccf38efb37f
Introduced
b0993b7e4d9c860133365d115b176bc6e0f57022
Fixed
098b848ee6688cb9a252d9ce97889defc517ee88
Fixed
4088381ccfaf241d7d42c333de0dc8c98e338743
Database specific 
{
    "cpe": "cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.29.8"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.8.0"
        },
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.1.7"
        },
        {
            "introduced": "2.2.0"
        },
        {
            "fixed": "2.3.6"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.0.0
1.0.0-beta2
1.1.0
1.10.0
1.10.1
1.11.0
1.12.0
1.13.0
1.14.0
1.14.1
1.15.0
1.16.0
1.17.0
1.17.1
1.18.0
1.19.0
1.2.0
1.2.1
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.24.1
1.25.0
1.25.1
1.25.2
1.27.0
1.28.0
1.29.0
1.29.1
1.29.2
1.29.4
1.29.5
1.29.6
1.29.7
1.3.0
1.3.1
1.4.0
1.4.1
1.5.0
1.6.0
1.7.0
1.8.0
1.8.1
1.8.2
2.*
2.0.0
2.1.0
2.1.1
2.1.3
2.1.4
2.1.5
2.1.6
2.2.0
2.2.1
2.2.2
2.3.0
2.3.2
2.3.3
2.3.4
2.3.5
3.*
3.3.0
3.4.0
3.5.0
3.6.0
3.7.0
Other
phpexcel-last-cherry-picked-commit
phpexcel-last-release-1.*
phpexcel-last-release-1.8.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-22131.json"