CVE-2019-12331

PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared in the header. This was a security measurement to prevent CVE-2018-19277 but the fix is not sufficient. By double-encoding the the xml payload to utf-7 it is possible to bypass the check for the string ‚<!ENTITY‘ and thus allowing for an xml external entity processing (XXE) attack.

• CWE-611

• https://github.com/PHPOffice/PhpSpreadsheet/blob/master/CHANGELOG.md#180---2019-07-01Third Party Advisory
• https://herolab.usd.de/security-advisories/usd-2019-0046/Exploit, Third Party Advisory
• https://github.com/PHPOffice/PhpSpreadsheet/blob/master/CHANGELOG.md#180---2019-07-01Third Party Advisory
• https://herolab.usd.de/security-advisories/usd-2019-0046/Exploit, Third Party Advisory

Published

Nov 7, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-12324A command injection (missing input validation) issue in the …7.2
• CVE-2019-12325The Htek UC902 VoIP phone web management interface contains …8.8
• CVE-2019-12326Missing file and path validation in the ringtone upload func…7.2
• CVE-2019-12327Hardcoded credentials in the Akuvox R50P VoIP phone 50.0.6.1…7.2
• CVE-2019-12328A command injection (missing input validation) issue in the …9
• CVE-2019-1233A denial of service vulnerability exists in Microsoft Exchan…7.5
• CVE-2019-1234A spoofing vulnerability exists when Azure Stack fails to va…7.5
• CVE-2019-12345XSS exists in the Kiboko Hostel plugin before 1.1.4 for Word…
• CVE-2019-12346In the miniOrange SAML SP Single Sign On plugin before 4.8.7…
• CVE-2019-12347In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when …
• CVE-2019-12348An issue was discovered in zzcms 2019. SQL Injection exists …9.8
• CVE-2019-12349An issue was discovered in zzcms 2019. SQL Injection exists …9.8