{"id":"GHSA-44jg-mv3h-wj6g","aliases":[],"url":"https://o3.security/vulnerability/GHSA-44jg-mv3h-wj6g","summary":"solspace/craft-freeform Vulnerable to XSS in `PhpSpreadsheet` HTML Writer Due to Unsanitized Styling Data","details":"### Summary\n_Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server._\n\n\\PhpOffice\\PhpSpreadsheet\\Writer\\Html doesn't sanitize spreadsheet styling information such as font names, allowing an attacker to inject arbitrary JavaScript on the page.\n\n### Details\n_Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._\n\nSee https://github.com/advisories/GHSA-wgmf-q9vr-vww6\n\n### PoC\n_Complete instructions, including specific configuration details, to reproduce the vulnerability._\n\nExample target script:\n\n```\n<?php\n\nrequire 'vendor/autoload.php';\n\n$reader = \\PhpOffice\\PhpSpreadsheet\\IOFactory::createReader(\"Xlsx\");\n$spreadsheet = $reader->load(__DIR__ . '/book.xlsx');\n\n$writer = new \\PhpOffice\\PhpSpreadsheet\\Writer\\Html($spreadsheet);\nprint($writer->generateHTMLAll());\n```\n\nSave this file in the same directory:\n\n[book.xlsx](https://github.com/PHPOffice/PhpSpreadsheet/files/15212797/book.xlsx)\n\nOpen index.php in a web browser. An alert should be displayed.\n\n### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nFull takeover of the session of users viewing spreadsheet files as HTML.","published":"2026-01-15T22:40:42Z","modified":"2026-02-03T03:17:27.874149Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"solspace/craft-freeform","fixedVersion":"4.1.23"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-wgmf-q9vr-vww6"},{"type":"WEB","url":"https://github.com/solspace/craft-freeform/security/advisories/GHSA-44jg-mv3h-wj6g"},{"type":"PACKAGE","url":"https://github.com/solspace/craft-freeform"},{"type":"WEB","url":"https://github.com/solspace/craft-freeform/releases/tag/v4.1.23"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-02-03T03:17:27.874149Z"}}