CVE-2026-40296

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The HTML writer skips htmlspecialchars escaping when a cell's formatted value differs from the original value. When a cell has a custom number format containing the text placeholder @ along with any additional literal characters (for example ". @", "@ ", or "x@"), the formatter replaces @ with the cell value and adds the extra characters, causing the formatted value to differ from the original and bypassing HTML escaping entirely. An attacker who can control the cell value and number format of an uploaded spreadsheet that is later converted to HTML and displayed to other users can achieve stored cross-site scripting. This issue is fixed in versions 5.7.0, 3.10.5, 2.4.5, 2.1.16, and 1.30.4.

• CWE-79

• https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-hrmw-qprp-wgmcExploit, Mitigation, Vendor Advisory
• https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-hrmw-qprp-wgmcExploit, Mitigation, Vendor Advisory

Published

May 6, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40289PraisonAI is a multi-agent teams system. In versions below 4…9.1
• CVE-2026-4029The Database Backup for WordPress plugin for WordPress is vu…7.5
• CVE-2026-40290OP-TEE is a Trusted Execution Environment (TEE) designed as …7.8
• CVE-2026-40291Chamilo LMS is an open-source learning management system. In…8.8
• CVE-2026-40293OpenFGA is an authorization/permission engine built for deve…6.5
• CVE-2026-40295Devise is an authentication solution for Rails based on Ward…6.1
• CVE-2026-40299next-intl provides internationalization for Next.js. Applica…6.9
• CVE-2026-4030The Database Backup for WordPress plugin for WordPress is vu…8.1
• CVE-2026-40300Zulip is an open-source team collaboration tool. Prior to 12…6.5
• CVE-2026-40301DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Pri…4.7
• CVE-2026-40302zrok is software for sharing web services, files, and networ…6.1
• CVE-2026-40303zrok is software for sharing web services, files, and networ…7.5