CVE-2025-22131: PhpSpreadsheet Cross-Site Scripting (XSS) Vulnerability in generateNavigation() Function
Summary
CVE-2025-22131: Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet. Affects phpoffice/phpspreadsheet across 4 version ranges.
< 1.29.8
>= 2.0.0, < 2.1.7
>= 2.2.0, < 2.3.6
>= 3.0.0, < 3.8.0
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PhpSpreadsheet is a popular open-source library used for reading and writing spreadsheet files in various formats, including XLSX. It provides a set of features that allow developers to manipulate spreadsheet data easily. However, the library has a vulnerability that arises when generating HTML representations of XLSX files containing multiple sheets, specifically in the navigation menu that displays sheet names without proper sanitization.
Vulnerability Detail
The vulnerability is a Cross-Site Scripting (XSS) issue found in the generateNavigation() function of PhpSpreadsheet. It occurs when the library generates HTML from an XLSX file with multiple sheets. The sheet names are included in the navigation menu without any sanitization, allowing an attacker to inject malicious JavaScript code. This could lead to various security risks, including session hijacking, phishing attacks, and unauthorized access to user data.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.29.81.29.8composer require phpoffice/phpspreadsheet:1.29.8 -
>= 2.0.0, < 2.1.72.1.7composer require phpoffice/phpspreadsheet:2.1.7 -
>= 2.2.0, < 2.3.62.3.6composer require phpoffice/phpspreadsheet:2.3.6 -
>= 3.0.0, < 3.8.03.8.0composer require phpoffice/phpspreadsheet:3.8.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using PhpSpreadsheet to generate HTML from XLSX files that contain untrusted or user-generated content until the library is updated. Ensure that sheet names are sanitized before being processed by the library.
Conclusion
The CVE-2025-22131 vulnerability in PhpSpreadsheet poses a significant risk due to its potential for XSS attacks. It is crucial for developers using this library to update to the latest patched versions and implement necessary workarounds to mitigate risks until updates can be applied.
See every vulnerability recorded for phpoffice/phpspreadsheet →
FAQ
The XSS vulnerability can lead to session hijacking, data theft, redirection to malicious sites, and unauthorized actions on behalf of the user.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Versions prior to 3.8.0, 1.29.8, 2.1.7, and 2.3.6 are vulnerable to this XSS issue.
Vulert monitors and alerts for open-source vulnerabilities in your software by analyzing the composer.lock file, providing real-time updates.
If an immediate update is not possible, ensure that you sanitize any user-generated content and avoid generating HTML from untrusted XLSX files.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpoffice/phpspreadsheet.
