CVE-2024-56366
HighAdvisory
Published 3 Jan 2025In the index since 6 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.1
- base score, highest
- EPSS
- 0.003
- 26th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 18
- of 17,781 indexed, latest versions
- Container images
- 11
- deployed by those charts
- Fix available
- 1 of 2
- affected packages
PhpSpreadsheet allows unauthorized Reflected XSS in the Accounting.php file
Carried by container images the latest versions of 18 of 17,781 indexed charts deploy, on 11 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| phpoffice/ | 1.18.0, 1.19.0, 1.21.0, 1.23.0+4 more | 1.29.7 | 9 |
| phpoffice/ | 1.8.1, 1.8.2 | no fix listed | 2 |
- OSV records
- GHSA-c6fv-7vh8-2rhr
Charts affected
18 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| snipeitt3n | 3.4.1 | 1 of 2See more | 18,509 |
| mauticone-acre-fundVerified publisher | 0.1.7 | 1 of 3See more | 2,667 |
| brpservicebrpservice | 1.1.0 | 1 of 4See more | 7,830 |
| commonground-gatewaycommonground-gateway | 1.5.4 | 1 of 7See more | 9,724 |
| opencatalogiopencatalogi | 1.0.6 | 1 of 8See more | 14,838 |
| polrchristianhuthVerified publisher | 4.3.0 | 1 of 2See more | 5,904 |
| commonground-gatewaycommonground-gateway-frontend | 0.1.5 | 1 of 4See more | 2,825 |
| mauticdevtron | 0.1.3 | 1 of 3See more | 2,939 |
| mauticdevtron-labs | 0.1.3 | 1 of 3See more | 2,939 |
| equizequiz | 0.0.1 | 1 of 3See more | 7,541 |
| equizequiz-chart | 0.0.1 | 1 of 3See more | 7,541 |
| anonaddygeek-cookbookVerified publisher | 6.0.0 | 1 of 1See more | 4,788 |
| openemrgeek-cookbookVerified publisher | 5.2.0 | 1 of 1See more | 8,392 |
| fossologymidokura-communityVerified publisher | 0.2.2 | 1 of 2See more | 3,294 |
| akauntingnas-helm-chartsVerified publisher | 1.0.3 | 1 of 2See more | 12,813 |
| commonground-gatewayopencatalogi | 1.5.3 | 1 of 7See more | 9,724 |
| mauticromholdings | 0.1.3 | 1 of 3See more | 2,939 |
| commonground-gatewayskeleton-pip | 0.1.7 | 1 of 5See more | 2,825 |
Container images carrying it
11 by charts deploying them
A fixed version is listed for 1 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| ghcr.io/ | 947882bf2c37 | phpoffice/ | 1.29.7 | 5 |
| mautic/ | a954c5868d76 | phpoffice/ | no fix listed | 3 |
| yzhou442/ | a3f7ca69e28d | phpoffice/ | 1.29.7 | 2 |
| ajanvier/ | 91ac61b88c85 | phpoffice/ | no fix listed | 1 |
| akaunting/ | 52811b36ec3a | phpoffice/ | 1.29.7 | 1 |
| anonaddy/ | 957a95565166 | phpoffice/ | 1.29.7 | 1 |
| fossology/ | 8bd1f22ba7bb | phpoffice/ | 1.29.7 | 1 |
| mautic/ | 94ea4acf4049 | phpoffice/ | 1.29.7 | 1 |
| openemr/ | 89eaa6d9a4e3 | phpoffice/ | 1.29.7 | 1 |
| snipe/ | 55fb7636a98c | phpoffice/ | 1.29.7 | 1 |
| ghcr.io/ | c17f1ba17d36 | phpoffice/ | 1.29.7 | 1 |