Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The HTML writer skips htmlspecialchars escaping when a cell's formatted value differs from the original value. When a cell has a custom number format containing the text placeholder @ along with any additional literal characters (for example ". @", "@ ", or "x@"), the formatter replaces @ with the cell value and adds the extra characters, causing the formatted value to differ from the original and bypassing HTML escaping entirely. An attacker who can control the cell value and number format of an uploaded spreadsheet that is later converted to HTML and displayed to other users can achieve stored cross-site scripting. This issue is fixed in versions 5.7.0, 3.10.5, 2.4.5, 2.1.16, and 1.30.4.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-29 | 2 | Disclosure2 |
| 2026-04-30 | 3 | Disclosure2General1 |
| 2026-05-07 | 3 | Disclosure2General1 |
CVE-2026-40296 · 5.6.0 → 9.8 TL;DR A critical stored XSS vulnerability in PhpSpreadsheet (CVSS 9.8) allows attackers to inject malicious JavaScript into applications by exploiting a conditional HTML-escaping flaw.
Post summary
A critical stored XSS vulnerability (CVE‑2026‑40296) in PhpSpreadsheet (CVSS 9.8) permits malicious JavaScript injection via a conditional HTML‑escaping flaw.
PhpOffice's PhpSpreadsheet, a widely-used PHP library for reading and writing Excel files, contains a logic flaw in its HTML writer that completely bypasses HTML entity encoding under specific conditions. The vulnerability (CVE-2026-40296) affects all versions up to 5.6.0…
Post summary
A logic flaw in PhpSpreadsheet's HTML writer allows bypass of HTML entity encoding in all versions up to 5.6.0, marking it as a disclosed vulnerability.
🚨*CVE* CVE-2026-40296 PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The HTML writer skips htmlspecialchars escaping when a cell's formatted value differs … https://www.cve.org/CVERecord?id=CVE-2026-40296 ----- Traducción: CVE-2026-40296 Php… http://infoflow.cloud`
Post summary
The notice reports CVE‑2026‑40296, highlighting a PhpSpreadsheet issue where the HTML writer fails to escape characters, potentially enabling XSS; no PoC, exploit, or patch is mentioned.
CVE-2026-40296 PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The HTML writer skips htmlspecialchars escaping when a cell's formatted value differs … https://www.cve.org/CVERecord?id=CVE-2026-40296
Post summary
The post shares a short technical detail about CVE-2026-40296 in PhpSpreadsheet—namely a missing htmlspecialchars escape in the HTML writer—and links to the CVE record, but offers no PoC, exploit, patch, or evidence of active exploitation.
CVE-2026-40296 Stored Cross-Site Scripting in PhpSpreadsheet HTML Writer via Custom Num... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40296 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
The tweet announces CVE-2026-40296, a stored XSS flaw in PhpSpreadsheet, and directs readers to detailed vulnerability and notification links.
https://research.lyrie.ai/research/2026-04-29-phpspreadsheet-cve-2026-40296-xss #lyrie #cybersecurity #CVE #threatintel #zerodayattack
Post summary
The content lists a URL and several hashtags but provides no concrete details about the CVE’s exploitation, patch status, or technical characteristics.
🔴 PhpSpreadsheet, #HTML Escaping Bypass, #CVE-2026-40296 (Critical) https://dailycve.com/phpspreadsheet-html-escaping-bypass-cve-2026-40296-critical/
Post summary
CVE-2026-40296 for PhpSpreadsheet is disclosed as a critical HTML escaping bypass vulnerability.
🟠 PhpSpreadsheet, XSS, #CVE-2026-40296 (Moderate) https://dailycve.com/phpspreadsheet-xss-cve-2026-40296-moderate/
Post summary
The tweet announces CVE-2026-40296, an XSS vulnerability in PhpSpreadsheet, rating it as moderate severity.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | phpoffice | phpspreadsheet | - | - | - |