CVE-2025-22131: 
PHP vulnerability analysis and mitigation

PhpSpreadsheet, a PHP library for reading and writing spreadsheet files, contains a Cross-Site Scripting (XSS) vulnerability discovered in January 2025. The vulnerability exists in the code that translates XLSX files into HTML representation and specifically affects the generateNavigation() function. The vulnerability impacts multiple versions including 3.0.0-3.8.0, 1.x before 1.29.8, 2.0.0-2.1.7, and 2.2.0-2.3.6 (GitHub Advisory).

The vulnerability occurs in the navigation menu generation when handling multiple sheets in an XLSX file. Sheet names are not properly sanitized before being included in the HTML output, allowing for potential JavaScript code execution. The vulnerability has been assigned a CVSS v4 score of 5.1 (Moderate), with the following metrics: Network attack vector, Low attack complexity, No attack requirements, No privileges required, and Active user interaction required (GitHub Advisory).

The XSS vulnerability can lead to various security issues ranging from minor annoyances to complete account compromise. Potential impacts include session cookie disclosure (if HttpOnly flag is not set), user redirection to malicious sites, content modification including fake login page injection, automatic malicious file downloads, and unauthorized access to user's geolocation or camera (GitHub Advisory).

The vulnerability requires an attacker to create a malicious XLSX file with specially crafted sheet names containing JavaScript code. When this file is processed and displayed through the HTML generation feature, the malicious code can execute in the context of the user's browser (GitHub Advisory).

The vulnerability has been patched in versions 3.8.0, 1.29.8, 2.1.7, and 2.3.6. Users should upgrade to these or later versions to mitigate the vulnerability. The fix involves properly sanitizing sheet names using htmlspecialchars() before including them in the HTML output (GitHub Advisory).