---
id: 4209
title: "[CVE-2018-19277] PhpSpreadsheet Versions<=1.5.0 - XXE injection"
cve: CVE-2018-19277
source_domain: bishopfox.com
source_url: "https://bishopfox.com/blog/phpspreadsheet-versions1.5.0-xxe-advisory"
published_at: "2018-11-30T00:00:00Z"
tags: ["php", "vulnerability", "xxe", "phpspreadsheet", "cve-2018-19277", "file-read"]
phying_url: "https://phying.com/item/4209"
lang: en
---

# [CVE-2018-19277] PhpSpreadsheet Versions<=1.5.0 - XXE injection

## Summary

PhpSpreadsheet up to 1.5.0 is vulnerable to XXE (CVE-2018-19277): attackers bypass its entity check with a UTF-7 encoded XLSX payload to read files, secrets and source code.

## Intelligence Metadata

- **Sources:** bishopfox.com
- **CVE:** CVE-2018-19277
- **Published:** 2018-11-30T00:00:00Z
- **Original:** https://bishopfox.com/blog/phpspreadsheet-versions1.5.0-xxe-advisory
- **Phying News:** https://phying.com/item/4209