Executive Summary

The CVE-2026-35453 vulnerability in PhpSpreadsheet is a Cross-Site Scripting (XSS) issue in the HTML Writer component. It occurs when a spreadsheet cell uses a custom number format containing the @ text placeholder along with additional literal text (for example, @ "items" or "Total: "@). In these cases, the HTML Writer skips the proper escaping of HTML special characters by the htmlspecialchars() function because the formatted output differs from the original cell value.

This means that an attacker who can control the content of a cell in a spreadsheet processed by PhpSpreadsheet's HTML Writer can inject arbitrary HTML or JavaScript into the generated HTML output, potentially leading to XSS attacks.

The vulnerability affects PhpSpreadsheet versions 1.30.3 and earlier, 2.0.0 through 2.1.15, 2.2.0 through 2.4.4, 3.3.0 through 3.10.4, and 4.0.0 through 5.6.0, and has been fixed in later versions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to inject malicious HTML or JavaScript code into the HTML output generated by PhpSpreadsheet when processing specially crafted spreadsheet files.

If the generated HTML is served from a web server, this can lead to Cross-Site Scripting (XSS) attacks, which may allow attackers to execute arbitrary scripts in the context of the victim's browser.

Such attacks can result in theft of user credentials, session hijacking, defacement, or other malicious activities depending on the context in which the HTML output is used.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying usage of vulnerable PhpSpreadsheet versions (1.30.3 and earlier, 2.0.0 through 2.1.15, 2.2.0 through 2.4.4, 3.3.0 through 3.10.4, and 4.0.0 through 5.6.0) and checking for processing of spreadsheet files that contain cells with custom number formats using the @ text placeholder combined with additional literal text.

You can scan your systems or applications for the PhpSpreadsheet library version by running commands such as:

• For PHP Composer projects: `composer show phpoffice/phpspreadsheet | grep versions`
• For manual installations, check the version in the PhpSpreadsheet source files or documentation.

Additionally, to detect potential exploitation attempts, monitor logs or inputs for spreadsheet files containing custom number formats with the @ placeholder and literal text, especially if these files are processed to generate HTML output.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade the PhpSpreadsheet library to a fixed version. The vulnerability has been patched in versions 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0.

If upgrading is not immediately possible, avoid processing or accepting spreadsheet files that contain cells with custom number formats using the @ placeholder combined with additional literal text, as these can be used to inject malicious HTML or JavaScript.

Also, ensure that any HTML output generated from spreadsheets is properly escaped and sanitized before being served to users.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in PhpSpreadsheet allows an attacker to inject arbitrary HTML and JavaScript into the generated HTML output via a Cross-Site Scripting (XSS) flaw. This could lead to unauthorized access or manipulation of data when the HTML output is served from a web server.

Such XSS vulnerabilities can impact compliance with standards like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access and disclosure. If exploited, this vulnerability could enable attackers to compromise data confidentiality and integrity, potentially leading to violations of these regulations.

Useful 0 Not Useful 0