CVE-2026-35453: 
PHP vulnerability analysis and mitigation

CVE-2026-35453 is a stored Cross-Site Scripting (XSS) vulnerability in the HTML Writer component of PHPOffice PhpSpreadsheet, a widely used PHP library for reading and writing spreadsheet files. The flaw allows an attacker who controls cell content to inject arbitrary HTML and JavaScript into HTML output generated from a spreadsheet. Affected versions include ≤1.30.3, 2.0.0–2.1.15, 2.2.0–2.4.4, 3.3.0–3.10.4, and 4.0.0–5.6.0. The vulnerability was published on May 5, 2026, with the GitHub Security Advisory (GHSA-6wpp-88cp-7q68) originally published April 26, 2026. It carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 4.8 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is CWE-79/CWE-80 — Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting). In Html.php (lines 1586–1594), htmlspecialchars() escaping is only applied when the formatted cell output strictly equals the original cell value ($cellData === $origData). When a custom number format uses the @ text placeholder combined with additional quoted literal text (e.g., @ "items" or "Total: "@), the formatter in Formatter.php (lines 136–152) substitutes the raw cell value into the format string and returns early — bypassing the formatColor callback that would have invoked htmlspecialchars(). An attacker with the ability to set cell content and apply a custom number format (e.g., by uploading a crafted XLSX file) can inject payloads such as <img src=x onerror=alert(document.domain)> that appear unescaped in the generated HTML output (GitHub Advisory).

Successful exploitation enables injection of arbitrary HTML and JavaScript into HTML pages generated by PhpSpreadsheet's HTML Writer. If the generated HTML is served from a web server, this constitutes a classic stored XSS attack, allowing session hijacking, credential theft, or malicious redirects against users who view the page. If the generated HTML file is downloaded and opened locally, the attack surface is more limited but still present. Confidentiality and integrity of the downstream user's browser session are at risk, though availability is not directly impacted (GitHub Advisory).

A proof-of-concept (PoC) PHP script (test.php) is publicly available in the GitHub Security Advisory, demonstrating creation of a malicious XLSX file that produces unescaped XSS payload output via $writer->generateHTMLAll(). Exploitation requires low privileges (an authenticated user who can control cell content) and user interaction (a victim must view the generated HTML). There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.015% (0.000150), indicating low current exploitation probability (GitHub Advisory).

1. Craft a malicious XLSX file: Create a spreadsheet where a target cell (e.g., A1) contains an XSS payload such as <img src=x onerror=alert(document.domain)> and applies a custom number format like @ "items" or "Total: "@.
2. Upload or supply the file: Deliver the crafted XLSX to a target application that uses PhpSpreadsheet's HTML Writer to render spreadsheet content as HTML (e.g., a file upload feature, a shared document platform).
3. Trigger HTML generation: Cause the application to process the spreadsheet using Html::generateHTMLAll() or equivalent. The formatter substitutes the raw cell value (containing the payload) into the format string and returns early, skipping htmlspecialchars() escaping.
4. Achieve XSS execution: When a victim user views the generated HTML page in their browser, the unescaped payload executes in their browser context, enabling session theft, credential harvesting, or further attacks (GitHub Advisory).

• File System: Presence of XLSX files with cells containing HTML/JavaScript tags (e.g., <script>, <img src=x onerror=...>) combined with custom number formats using @ with quoted literal text (e.g., @ "items").
• Application Output: Generated HTML files or responses containing unescaped HTML tags within spreadsheet table cells, particularly patterns like <img src=x onerror=...> items or Total: <script>....
• Logs: Web server or application logs showing uploads of XLSX files followed by HTML generation requests; error logs from browsers reporting XSS-related content security policy violations.
• Network: Unexpected outbound requests from user browsers to attacker-controlled domains shortly after viewing spreadsheet-generated HTML pages (indicative of XSS payload execution).

Upgrade PhpSpreadsheet to a patched version: 1.30.4 (for 1.x branch), 2.1.16 (for 2.0–2.1), 2.4.5 (for 2.2–2.4), 3.10.5 (for 3.3–3.10), or 5.7.0 (for 4.0+). If immediate patching is not feasible, restrict who can upload or modify spreadsheets processed by the HTML Writer, and implement server-side input validation to sanitize cell content before processing. Additionally, consider serving generated HTML with a strict Content Security Policy (CSP) to limit the impact of any injected scripts (GitHub Advisory, Red Hat CVE).

The vulnerability was reported by security researcher marduc812 and published via GitHub's security advisory program. A brief social media mention appeared on Bluesky shortly after disclosure. Coverage has been picked up by vulnerability aggregators including Vulners, VulDB, and CVEFeed, as well as a dedicated technical write-up on infinitsec.net. No major vendor statements beyond the PHPOffice advisory have been issued (GitHub Advisory).