CVE-2026-40296

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-40296
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40296.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-40296
Aliases
Published
2026-05-06T20:48:34.504Z
Modified
2026-07-08T08:13:12.793813707Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
PhpSpreadsheet vulnerable to XSS in HTML writer via custom number format codes
Details

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The HTML writer skips htmlspecialchars escaping when a cell's formatted value differs from the original value. When a cell has a custom number format containing the text placeholder @ along with any additional literal characters (for example ". @", "@ ", or "x@"), the formatter replaces @ with the cell value and adds the extra characters, causing the formatted value to differ from the original and bypassing HTML escaping entirely. An attacker who can control the cell value and number format of an uploaded spreadsheet that is later converted to HTML and displayed to other users can achieve stored cross-site scripting. This issue is fixed in versions 5.7.0, 3.10.5, 2.4.5, 2.1.16, and 1.30.4.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40296.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79"
    ]
}
References

Affected packages

Git / github.com/phpoffice/phpspreadsheet

Affected ranges

Type
GIT
Repo
https://github.com/phpoffice/phpspreadsheet
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
02970383cc12e7bf0bc0707ea6e2e8ed23a7aec9
Introduced
4a77798f835119754961a97714f135826a323caa
Fixed
c91ff54b743e3f70f880e7145a9821474cd82f16
Introduced
b0993b7e4d9c860133365d115b176bc6e0f57022
Fixed
ec7815be350e03df90f3e2ace92653fa6cb4327c
Introduced
87ddd21eb0b6b7ad20a11d314348ef307475f547
Fixed
13f709c73e417c3c8cadc87ac88f809fd8d1fa45
Introduced
2d4b9f3582102aafb6b1378fff8a20eeeacfb31c
Fixed
9f55d3b9b7bcb1084fda8340e4b7ce4ed10cd0c8
Database specific 
{
    "cpe": "cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.30.4"
        },
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.1.16"
        },
        {
            "introduced": "2.2.0"
        },
        {
            "fixed": "2.4.5"
        },
        {
            "introduced": "3.3.0"
        },
        {
            "fixed": "3.10.5"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "5.7.0"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

1.*
1.0.0
1.0.0-beta2
1.1.0
1.10.0
1.10.1
1.11.0
1.12.0
1.13.0
1.14.0
1.14.1
1.15.0
1.16.0
1.17.0
1.17.1
1.18.0
1.19.0
1.2.0
1.2.1
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.24.1
1.25.0
1.25.1
1.25.2
1.27.0
1.28.0
1.29.0
1.29.1
1.29.10
1.29.11
1.29.12
1.29.2
1.29.4
1.29.5
1.29.6
1.29.7
1.29.8
1.29.9
1.3.0
1.3.1
1.30.0
1.30.1
1.30.2
1.30.3
1.4.0
1.4.1
1.5.0
1.6.0
1.7.0
1.8.0
1.8.1
1.8.2
2.*
2.0.0
2.1.0
2.1.1
2.1.10
2.1.11
2.1.12
2.1.13
2.1.14
2.1.15
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.2.0
2.2.1
2.2.2
2.3.0
2.3.10
2.3.2
2.3.3
2.3.4
2.3.5
2.3.6
2.3.7
2.3.8
2.3.9
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
3.*
3.10.0
3.10.1
3.10.2
3.10.3
3.10.4
3.3.0
3.4.0
3.5.0
3.6.0
3.7.0
3.8.0
3.9.0
3.9.1
3.9.2
3.9.3
4.*
4.0.0
4.1.0
4.2.0
4.3.0
4.3.1
4.4.0
4.5.0
5.*
5.0.0
5.1.0
5.2.0
5.3.0
5.4.0
5.5.0
5.6.0
Other
phpexcel-last-cherry-picked-commit
phpexcel-last-release-1.*
phpexcel-last-release-1.8.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40296.json"