{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "cpe": "cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*",
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "fixed": "1.29.7"
              },
              {
                "introduced": "2.0.0"
              },
              {
                "fixed": "2.1.6"
              },
              {
                "introduced": "2.2.0"
              },
              {
                "fixed": "2.3.5"
              },
              {
                "introduced": "3.3.0"
              },
              {
                "fixed": "3.7.0"
              }
            ],
            "source": [
              "CPE_RANGE",
              "REFERENCES"
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "02c8625411dcb96e1f63d58c47460284e15b2e80"
            },
            {
              "introduced": "4a77798f835119754961a97714f135826a323caa"
            },
            {
              "fixed": "04e8b6edc1bba1bbc8e1aef4111903d11e8323c1"
            },
            {
              "introduced": "b0993b7e4d9c860133365d115b176bc6e0f57022"
            },
            {
              "fixed": "d836f2d7308a192441ccd1546545890b378af913"
            },
            {
              "introduced": "87ddd21eb0b6b7ad20a11d314348ef307475f547"
            },
            {
              "fixed": "2fc12fdc58d39297c7b8c72d65b37a1a25d65ab5"
            },
            {
              "fixed": "700a80346be269af668914172bc6f4521982d0b4"
            },
            {
              "fixed": "9b9a55c7154daa7cd4095f618933c240508ba3c1"
            },
            {
              "fixed": "a50ebfe118b3ae0ddaea1c48ac19dc38692f4abc"
            },
            {
              "fixed": "b8fac55aa5cb7a3d514c7308378bb37bb711b25e"
            }
          ],
          "repo": "https://github.com/phpoffice/phpspreadsheet",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-x88g-h956-m5xg"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56408.json"
  },
  "details": "PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have no sanitization in the `/vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.php` file, which leads to the possibility of a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.",
  "id": "CVE-2024-56408",
  "modified": "2026-08-12T03:51:20.223545655Z",
  "published": "2025-01-03T16:05:22.944Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56408.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-x88g-h956-m5xg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56408"
    },
    {
      "type": "FIX",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/700a80346be269af668914172bc6f4521982d0b4"
    },
    {
      "type": "FIX",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/9b9a55c7154daa7cd4095f618933c240508ba3c1"
    },
    {
      "type": "FIX",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/a50ebfe118b3ae0ddaea1c48ac19dc38692f4abc"
    },
    {
      "type": "FIX",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/b8fac55aa5cb7a3d514c7308378bb37bb711b25e"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L",
      "type": "CVSS_V4"
    }
  ],
  "summary": "PhpSpreadsheet allows unauthorized reflected XSS in `Convert-Online.php` file"
}