Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

phpoffice/phpspreadsheet

              master @ 11645d5
            

Fixes

CVEs

HIGH

Peak severity

44.4%

Coverage

Highlights

XXE: 17 prior fixes. Scrutinize any change in this area.

src/PhpSpreadsheet/Reader/Security/XmlScanner.php: most-fixed (10 issues). Treat as high-risk during review.

24 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

XXE: The scanner is the primary defense against XXE but has been bypassed repeatedly via encoding tricks (UTF-7, EBCDIC, single-quoted, case-insensitive, whitespace) and entity-detection regex gaps.

XXE: Legacy reader base class had XXE detection gaps, particularly for UTF-16 encodings and incomplete DOCTYPE/ENTITY regex patterns.

Reflected XSS: HTML output sanitization has been unstable, with multiple switches between sanitizers (HTMLPurifier, voku/anti-xss) and specific sinks like cell comments and font names lacking consistent encoding.