CVE-2025-23210
MediumAdvisory
Published 3 Feb 2025In the index since 6 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.4
- base score, highest
- EPSS
- 0.004
- 35th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 18
- of 17,781 indexed, latest versions
- Container images
- 11
- deployed by those charts
- Fix available
- 1 of 2
- affected packages
PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters
Carried by container images the latest versions of 18 of 17,781 indexed charts deploy, on 11 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| phpoffice/ | 1.18.0, 1.19.0, 1.21.0, 1.23.0+4 more | 1.29.9 | 9 |
| phpoffice/ | 1.8.1, 1.8.2 | no fix listed | 2 |
- OSV records
- GHSA-r57h-547h-w24f
Charts affected
18 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| snipeitt3n | 3.4.1 | 1 of 2See more | 18,509 |
| mauticone-acre-fundVerified publisher | 0.1.7 | 1 of 3See more | 2,667 |
| brpservicebrpservice | 1.1.0 | 1 of 4See more | 7,830 |
| commonground-gatewaycommonground-gateway | 1.5.4 | 1 of 7See more | 9,724 |
| opencatalogiopencatalogi | 1.0.6 | 1 of 8See more | 14,838 |
| polrchristianhuthVerified publisher | 4.3.0 | 1 of 2See more | 5,904 |
| commonground-gatewaycommonground-gateway-frontend | 0.1.5 | 1 of 4See more | 2,825 |
| mauticdevtron | 0.1.3 | 1 of 3See more | 2,939 |
| mauticdevtron-labs | 0.1.3 | 1 of 3See more | 2,939 |
| equizequiz | 0.0.1 | 1 of 3See more | 7,541 |
| equizequiz-chart | 0.0.1 | 1 of 3See more | 7,541 |
| anonaddygeek-cookbookVerified publisher | 6.0.0 | 1 of 1See more | 4,788 |
| openemrgeek-cookbookVerified publisher | 5.2.0 | 1 of 1See more | 8,392 |
| fossologymidokura-communityVerified publisher | 0.2.2 | 1 of 2See more | 3,294 |
| akauntingnas-helm-chartsVerified publisher | 1.0.3 | 1 of 2See more | 12,813 |
| commonground-gatewayopencatalogi | 1.5.3 | 1 of 7See more | 9,724 |
| mauticromholdings | 0.1.3 | 1 of 3See more | 2,939 |
| commonground-gatewayskeleton-pip | 0.1.7 | 1 of 5See more | 2,825 |
Container images carrying it
11 by charts deploying them
A fixed version is listed for 1 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| ghcr.io/ | 947882bf2c37 | phpoffice/ | 1.29.9 | 5 |
| mautic/ | a954c5868d76 | phpoffice/ | no fix listed | 3 |
| yzhou442/ | a3f7ca69e28d | phpoffice/ | 1.29.9 | 2 |
| ajanvier/ | 91ac61b88c85 | phpoffice/ | no fix listed | 1 |
| akaunting/ | 52811b36ec3a | phpoffice/ | 1.29.9 | 1 |
| anonaddy/ | 957a95565166 | phpoffice/ | 1.29.9 | 1 |
| fossology/ | 8bd1f22ba7bb | phpoffice/ | 1.29.9 | 1 |
| mautic/ | 94ea4acf4049 | phpoffice/ | 1.29.9 | 1 |
| openemr/ | 89eaa6d9a4e3 | phpoffice/ | 1.29.9 | 1 |
| snipe/ | 55fb7636a98c | phpoffice/ | 1.29.9 | 1 |
| ghcr.io/ | c17f1ba17d36 | phpoffice/ | 1.29.9 | 1 |