XML External Entity Vulnerability in PHPOffice Common
CVE-2018-14065

9.8CRITICAL

Key Information:

Vendor: PHPoffice Project
Status: Common
Vendor: CVE Published:; 15 July 2018

🔔 Create PHPoffice Project Vulnerability Alert

What is CVE-2018-14065?

The PHPOffice Common library, specifically in the XMLReader.php file, is susceptible to XML External Entity (XXE) attacks prior to version 0.2.9. This vulnerability allows attackers to exploit the way XML data is processed, potentially leading to unauthorized access to sensitive data, server-side request forgery (SSRF), and other harmful consequences. It is crucial for users to upgrade to the latest version to mitigate risks associated with this vulnerability and ensure their applications remain secure.