GitHub Advisoryadvisory · Packagist

GHSA-28rm-rj57-qjpv PHPExcel vulnerable to XXE attacks through libxml

MEDIUM Published 2022-05-17 Modified 2025-03-31 Official page ↗
Aliases
CVE-2014-2054
Ecosystem
Packagist
Packages
phpoffice/phpexcel
Severity
Moderate
Weaknesses
CWE-611
Reviewed
2023-09-25

Affected packages

• Packagist phpoffice/phpexcel: < 1.8.0 → fixed in 1.8.0

Description

PHPExcel before 1.8.0, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, does not disable external entity loading in libxml, which allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.

Related

Alias · CVE (1)

  • CVE-2014-2054 PHPExcel before 1.8.0, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, does not disable external entity loading in libxml,… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References