CVE-2025-23210

Description

The vulnerability resides in the generateRow method of the Html writer in PhpSpreadsheet. The library attempts to sanitize hyperlink URLs by checking if the scheme is allowed (e.g., http, https, file, ftp, mailto, s3). However, due to insufficient input validation, an attacker can craft a URL starting with javascript: and include special characters such as whitespace or control characters (e.g., javascript\x00:...) that bypass the scheme check. This allows the URL to be rendered as a hyperlink in the generated HTML output, leading to XSS when a user interacts with the link [1][2].

Exploitation

An attacker can create a malicious spreadsheet file (e.g., XML format) containing a hyperlink with a javascript: URL that includes control characters or whitespace. When a server-side application reads this file and converts it to HTML using PhpSpreadsheet's Html writer, the malicious URL is output without proper sanitization. A victim viewing the generated HTML page and clicking the link will trigger arbitrary JavaScript execution in their browser. No authentication is required beyond the ability to upload or influence the spreadsheet file [2].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the user's browser. This can lead to data theft, session hijacking, defacement, or other malicious actions, depending on the application's trust level and the user's privileges [2].

Mitigation

The vulnerability has been addressed in PhpSpreadsheet versions 3.9.0, 2.3.7, 2.1.8, and 1.29.9. The fix includes additional sanitization that strips control characters from the URL (see commit [4]). There are no known workarounds, so users are strongly advised to upgrade to the latest patched version [1][4].