Cross-site Scripting (XSS)

Vulnerability

Overview

CVE-2020-7776 is a stored cross-site scripting (XSS) vulnerability in the PHPOffice PhpSpreadsheet library, affecting all versions prior to 1.16.0. The root cause lies in the HTML writer, which fails to sanitize user-controlled cell comments when generating HTML output from an Excel file. Comments are concatenated directly into the generated HTML without proper escaping, enabling an attacker to inject arbitrary JavaScript or HTML. [1][2][3]

Attack

Vector and Exploitation

An attacker can exploit this vulnerability by crafting an Excel file containing a malicious payload (e.g., `) within a cell comment. When this file is loaded and converted to HTML using the library's IOFactory::createWriter($spreadsheet, 'Html')` method, the injected script is embedded into the resulting HTML output. Any user who then views the generated HTML file in a browser will execute the attacker's script. No prior authentication is required; the attack only needs the victim to process a malicious Excel file through the affected library. [3]

Impact

Successful exploitation leads to stored XSS, which can be used to steal session cookies, redirect users to malicious sites, deface web content, or perform other actions within the context of the victim's browser session. Because the HTML output can be served to multiple users (e.g., in a web application that converts uploaded spreadsheets), the impact may extend to many victims. [1][2][3]

Mitigation

The vulnerability was fixed in commit 0ed5b800be2136bcb8fa9c1bdf59abc957a98845, and the patch is included in PhpSpreadsheet version 1.16.0 and later. Users should upgrade to the latest version of the library. No workaround is available if the HTML writer is used with untrusted Excel input. The vulnerability is publicly documented and proof-of-concept code exists. [1][3][4]