{"id":"GHSA-hq76-662x-7mw4","aliases":[],"title":"Pimcore includes vulnerable PHPOffice/PhpSpreadsheet","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"HIGH","description":"### Summary\nPimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: [GHSA-ghg6-32f9-2jp7](https://github.com/advisories/GHSA-ghg6-32f9-2jp7).\n\n","severity":"high","score":8.8,"published":"2024-09-03T19:45:26.000Z","modified":"2024-12-05T05:28:51.120Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"pimcore/data-importer","sources":[{"name":"OSV · GHSA-hq76-662x-7mw4","url":"https://osv.dev/vulnerability/GHSA-hq76-662x-7mw4"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.8.9"}],"type":"ECOSYSTEM"}],"versions":["v1.0","v1.0.1","v1.1","v1.1.1","v1.1.2","v1.1.3","v1.1.4","v1.1.5","v1.2.0","v1.2.1","v1.2.2","v1.3.0","v1.3.1","v1.3.2","v1.3.3","v1.3.4","v1.3.5","v1.3.6","v1.4.0","v1.4.1","v1.4.2","v1.4.3","v1.4.4","v1.4.5","v1.4.6","v1.5.0","v1.5.1","v1.6.0","v1.6.1","v1.6.2","v1.6.3","v1.6.4","v1.6.5","v1.7.0","v1.7.1","v1.7.2","v1.7.3","v1.7.4","v1.7.5","v1.8.0","v1.8.0-BETA1","v1.8.0-RC1","v1.8.1","v1.8.2","v1.8.3","v1.8.4","v1.8.5","v1.8.6","v1.8.7","v1.8.8"],"fixed":["1.8.9"]},{"ecosystem":"Packagist","name":"pimcore/data-importer","sources":[{"name":"OSV · GHSA-hq76-662x-7mw4","url":"https://osv.dev/vulnerability/GHSA-hq76-662x-7mw4"}],"ranges":[{"events":[{"introduced":"1.9.0"},{"fixed":"1.9.3"}],"type":"ECOSYSTEM"}],"versions":["v1.9.0","v1.9.1","v1.9.2"],"fixed":["1.9.3"]},{"ecosystem":"Packagist","name":"pimcore/admin-ui-classic-bundle","sources":[{"name":"OSV · GHSA-hq76-662x-7mw4","url":"https://osv.dev/vulnerability/GHSA-hq76-662x-7mw4"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.3.11"}],"type":"ECOSYSTEM"}],"versions":["v1.0.0","v1.0.0-BETA1","v1.0.0-RC1","v1.0.0-RC2","v1.0.1","v1.0.2","v1.0.3","v1.0.4","v1.0.5","v1.0.6","v1.1.0","v1.1.0-RC1","v1.1.1","v1.1.2","v1.1.3","v1.1.4","v1.2","v1.2.0-RC1","v1.2.1","v1.2.2","v1.2.3","v1.3.0","v1.3.0-RC1","v1.3.1","v1.3.2","v1.3.3","v1.3.4","v1.3.5"],"fixed":["1.3.11"]},{"ecosystem":"Packagist","name":"pimcore/admin-ui-classic-bundle","sources":[{"name":"OSV · GHSA-hq76-662x-7mw4","url":"https://osv.dev/vulnerability/GHSA-hq76-662x-7mw4"}],"ranges":[{"events":[{"introduced":"1.4.0"},{"fixed":"1.4.7"}],"type":"ECOSYSTEM"}],"versions":["1.4.0","v1.4.1","v1.4.2","v1.4.3","v1.4.4","v1.4.5"],"fixed":["1.4.7"]},{"ecosystem":"Packagist","name":"pimcore/admin-ui-classic-bundle","sources":[{"name":"OSV · GHSA-hq76-662x-7mw4","url":"https://osv.dev/vulnerability/GHSA-hq76-662x-7mw4"}],"ranges":[{"events":[{"introduced":"1.5.0"},{"fixed":"1.5.4"}],"type":"ECOSYSTEM"}],"versions":["v1.5.0","v1.5.1","v1.5.2","v1.5.3"],"fixed":["1.5.4"]},{"ecosystem":"Packagist","name":"pimcore/pimcore","sources":[{"name":"OSV · GHSA-hq76-662x-7mw4","url":"https://osv.dev/vulnerability/GHSA-hq76-662x-7mw4"}],"ranges":[{"events":[{"introduced":"10.6.9.0"},{"fixed":"10.6.9.12"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["10.6.9.12"]},{"ecosystem":"Packagist","name":"pimcore/pimcore","sources":[{"name":"OSV · GHSA-hq76-662x-7mw4","url":"https://osv.dev/vulnerability/GHSA-hq76-662x-7mw4"}],"ranges":[{"events":[{"introduced":"11.1.0.0"},{"fixed":"11.1.6.11"}],"type":"ECOSYSTEM"}],"versions":["v11.1.1","v11.1.2","v11.1.3","v11.1.4","v11.1.5","v11.1.6"],"fixed":["11.1.6.11"]}],"sourceAffected":[],"references":["https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4","https://github.com/advisories/GHSA-ghg6-32f9-2jp7","https://github.com/pimcore/pimcore"],"sources":[{"name":"OSV","id":"GHSA-hq76-662x-7mw4","modified":"2024-12-05T05:28:51.120085Z","url":"https://osv.dev/vulnerability/GHSA-hq76-662x-7mw4"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":8.8},{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":8.7}],"products":[],"remediation":[],"kev":{"status":"unavailable","checkedAt":"2026-10-28T19:20:37.165Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}