The vulnerability arises from the HTML writer in PhpSpreadsheet that omits htmlspecialchars escaping when a cell’s formatted value differs from the original value. When an attacker supplies a custom number format containing the placeholder @ together with literal characters, the formatter substitutes @ with the cell value and adds the literals, producing a formatted string that skips escaping. This allows an attacker who can control the cell value and number format of an uploaded spreadsheet that is later converted to HTML and served to users to inject arbitrary script code, resulting in stored cross‑site scripting. The impact is that any user viewing the rendered HTML could execute malicious code in their browser, compromising confidentiality, integrity, and availability of the affected application or its users.

This issue affects the PHPOffice PhpSpreadsheet library. Versions prior to 5.7.0, 3.10.5, 2.4.5, 2.1.16, or 1.30.4 are vulnerable. The vulnerability exists whenever the library’s HTML writer processes user‑supplied spreadsheets containing malicious custom number formats.

The CVSS score of 5.4 indicates a moderate impact, and the lack of an EPSS score means current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog, suggesting no active weaponized exploits are publicly known. The likely attack vector requires that an attacker be able to upload a spreadsheet that is later rendered to HTML for other users, a scenario common in shared document platforms or web applications that display spreadsheet content. If such a path exists, an attacker can achieve stored XSS, which may lead to credential theft or session hijacking.