CVE-2015-3542 PHPExcel XXE Vulnerability

HighCVSS 8.7 PoC

Published: Unknown
Updated: 2024-11-07 19:59
Exploit status: Proof-of-concept only

Sign in for asset impact Search another CVE

Description

PHPExcel XXE Vulnerability

Affected products

Product	Affected versions	Fixed in
phpoffice/phpexcel(Packagist)	< 1.8.1	1.8.1
phpoffice/phpexcel(Packagist)	= 1.7.9	No fix listed
phpoffice/phpexcel(Packagist)	= 1.7.9-rc1	No fix listed
phpoffice/phpexcel(Packagist)	= 1.8.0	No fix listed
phpoffice/phpexcel(Packagist)	= 1.8.0rc1	No fix listed
phpoffice/phpexcel(Packagist)	= 1.8.0rc2	No fix listed
phpoffice/phpexcel(Packagist)	= 1.8.0rc3	No fix listed
phpoffice/phpexcel(Packagist)	= 1.8.0rc4	No fix listed

References

github.com patch
github.com exploit
github.com product
github.com

CVSS v4.0

8.7 High

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: None
Vulnerable System Confidentiality: None
Vulnerable System Integrity: High
Vulnerable System Availability: None
Subsequent System Confidentiality: None
Subsequent System Integrity: None
Subsequent System Availability: None

All scores (2)

v4.0 – · osv:ghsa
v4.0 8.7 · github

Weakness & likelihood

EPSS (exploitation probability, 30 days): Not available
CWE: CWE-611 Improper Restriction of XML External Entity Reference

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

Proof of concept: github.com/FriendsOfPHP/security-advisories/blob/master/phpoffice/phpexcel/CVE-2015-3542.yaml PoC · GitHub public repositories · 2026-11-11