5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-40296

CVE-2026-40296: PhpSpreadsheet vulnerable to XSS in HTML writer via custom number format codes

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The HTML writer skips htmlspecialchars escaping when a cell's formatted value differs from the original value. When a cell has a custom number format containing the text placeholder @ along with any additional literal characters (for example ". @", "@ ", or "x@"), the formatter replaces @ with the cell value and adds the extra characters, causing the formatted value to differ from the original and bypassing HTML escaping entirely. An attacker who can control the cell value and number format of an uploaded spreadsheet that is later converted to HTML and displayed to other users can achieve stored cross-site scripting. This issue is fixed in versions 5.7.0, 3.10.5, 2.4.5, 2.1.16, and 1.30.4.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-40296

CVE-2026-40296:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
phpoffice/phpspreadsheet	composer	>= 4.0.0, <= 5.6.0	5.7.0
phpoffice/phpspreadsheet	composer	>= 3.3.0, <= 3.10.4	3.10.5
phpoffice/phpspreadsheet	composer	>= 2.2.0, <= 2.4.4	2.4.5
phpoffice/phpspreadsheet	composer	>= 2.0.0, <= 2.1.15	2.1.16
phpoffice/phpspreadsheet	composer	<= 1.30.3	1.30.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Cross-Site Scripting (XSS) issue within the phpoffice/phpspreadsheet library, specifically in its HTML writing component. The root cause is the improper handling of custom number formats, which allows for the bypass of HTML escaping mechanisms.

The investigation began by analyzing the version history of the package, comparing the last vulnerable version (5.6.0) with the first patched version (5.7.0). The commits between these versions were examined. The key commit, f1eb4e6980d537ec85fc20be5950f9ad65d47ffd, contained the security fix.

The vulnerability description points to a flawed conditional escaping logic in Writer/Html.php. However, the actual patch was applied in a different file, src/PhpSpreadsheet/Style/NumberFormat/Formatter.php, within the toFormattedString function. This function is responsible for applying number formats to cell values.

Prior to the patch, the toFormattedString function had a bug. When processing a number format containing the '@' text placeholder (without any quotes in the format string), it would perform a simple string replacement and return the result immediately. It failed to execute a callback function that the HTML writer passes to it. This callback is intended to perform htmlspecialchars escaping.

An attacker could exploit this by setting a cell's value to an XSS payload (e.g., <img src=x onerror=alert(1)>) and applying a custom number format like @ (with a trailing space). The Formatter::toFormattedString function would then return the payload with a space, but without HTML escaping. The calling function in Writer/Html.php would see that the formatted data is different from the original and would therefore skip its own htmlspecialchars call, leading to the payload being rendered unescaped in the final HTML.

The patch corrects the logic in toFormattedString to ensure that the provided callback is always executed, even for these simple '@' formats. This ensures that the value is properly HTML-escaped before being returned to the writer, thus mitigating the XSS vulnerability. The identified vulnerable function, PhpOffice\PhpSpreadsheet\Style\NumberFormat\Formatter::toFormattedString, is therefore the precise location of the exploitable bug.

Vulnerable functions

PhpOffice\PhpSpreadsheet\Style\NumberFormat\Formatter::toFormattedString

src/PhpSpreadsheet/Style/NumberFormat/Formatter.php

The vulnerability lies in this function's handling of number formats containing the '@' placeholder. The original code would return a formatted string without applying the provided callback function. In the context of the HTML Writer, this callback is used for HTML-escaping. By crafting a special number format, an attacker could ensure this callback was not executed, causing the raw, unescaped cell value to be embedded in the generated HTML, leading to a Cross-Site Scripting (XSS) vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.