phpoffice/phpspreadsheet version vulnerability and export to xls breakage

Collapse
X
Collapse
 
  • Page of 1
  • Time
  • Show
Clear All
new posts
Previous template Next
  • jamie
    Member
    • Aug 2025
    • 61
    #1

    phpoffice/phpspreadsheet version vulnerability and export to xls breakage

    Hi,

    I am getting the following error when I try to export a record to .xls format. I also note that it seems to be on v1.29.7 that has a severe security feature. .csv is working, though .xls fails everywhere we try

    Slim Application Error Type: Error Code: 0 Message: Class "MyCLabs\Enum\Enum" not found File: /var/www/html/vendor/maennchen/zipstream-php/src/Option/Method.php Line: 18 Trace: #0 /var/www/html/vendor/composer/ClassLoader.php(576): include() #1 /var/www/html/vendor/composer/ClassLoader.php(427): Composer\Autoload\{closure}('/var/www/html/v...') #2 /var/www/html/vendor/maennchen/zipstream-php/src/Option/Archive.php(131): Composer\Autoload\ClassLoader->loadClass('ZipStream\\Optio...') #3 /var/www/html/vendor/phpoffice/phpspreadsheet/src/PhpSpreadsheet/Writer/ZipStream2.php(15): ZipStream\Option\Archive->__construct() #4 /var/www/html/vendor/phpoffice/phpspreadsheet/src/PhpSpreadsheet/Writer/ZipStream0.php(15): PhpOffice\PhpSpreadsheet\Writer\ZipStream2::newZip Stream(Resource id #13) #5 /var/www/html/vendor/phpoffice/phpspreadsheet/src/PhpSpreadsheet/Writer/Xlsx.php(553): PhpOffice\PhpSpreadsheet\Writer\ZipStream0::newZip Stream(Resource id #13) #6 /var/www/html/application/Espo/Tools/Export/Format/Xlsx/PhpSpreadsheetProcessor.php(294): PhpOffice\PhpSpreadsheet\Writer\Xlsx->save(Resource id #13) #7 /var/www/html/application/Espo/Tools/Export/Format/Xlsx/Processor.php(66): Espo\Tools\Export\Format\Xlsx\PhpSpreadsheetProces sor->process(Object(Espo\Tools\Export\Processor\Para ms ), Object(Espo\Tools\Export\Collection)) #8 /var/www/html/application/Espo/Tools/Export/Format/Xlsx/Processor.php(57): Espo\Tools\Export\Format\Xlsx\Processor->processPhpSpreadsheet(Object(Espo\Tools\Export\ Pr ocessor\Params), Object(Espo\Tools\Export\Collection)) #9 /var/www/html/application/Espo/Tools/Export/Export.php(144): Espo\Tools\Export\Format\Xlsx\Processor->process(Object(Espo\Tools\Export\Processor\Para ms ), Object(Espo\Tools\Export\Collection)) #10 /var/www/html/application/Espo/Tools/Export/Service.php(96): Espo\Tools\Export\Export->run() #11 /var/www/html/application/Espo/Tools/Export/Api/PostProcess.php(56): Espo\Tools\Export\Service->process(Object(Espo\Tools\Export\Params), Object(Espo\Tools\Export\ServiceParams)) #12 /var/www/html/application/Espo/Core/Api/ActionHandler.php(73): Espo\Tools\Export\Api\PostProcess->process(Object(Espo\Core\Api\RequestWrapper)) #13 /var/www/html/vendor/slim/slim/Slim/MiddlewareDispatcher.php(73): Espo\Core\Api\ActionHandler->handle(Object(Slim\Psr7\Request)) #14 /var/www/html/application/Espo/Core/Api/RouteProcessor.php(176): Slim\MiddlewareDispatcher->handle(Object(Slim\Psr7\Request)) #15 /var/www/html/application/Espo/Core/Api/RouteProcessor.php(145): Espo\Core\Api\RouteProcessor->processAction('Espo\\Tools\\Expo...', Object(Espo\Core\Api\ProcessData), Object(Slim\Psr7\Request), Object(Espo\Core\Api\ResponseWrapper)) #16 /var/www/html/application/Espo/Core/Api/RouteProcessor.php(126): Espo\Core\Api\RouteProcessor->processAfterAuth(Object(Espo\Core\Api\ProcessDa ta ), Object(Slim\Psr7\Request), Object(Espo\Core\Api\ResponseWrapper)) #17 /var/www/html/application/Espo/Core/Api/RouteProcessor.php(78): Espo\Core\Api\RouteProcessor->processInternal(Object(Espo\Core\Api\ProcessDat a) , Object(Slim\Psr7\Request), Object(Espo\Core\Api\RequestWrapper), Object(Espo\Core\Api\ResponseWrapper)) #18 /var/www/html/application/Espo/Core/Api/Starter.php(126): Espo\Core\Api\RouteProcessor->process(Object(Espo\Core\Api\ProcessData), Object(Slim\Psr7\Request), Object(Slim\Psr7\Response)) #19 /var/www/html/vendor/slim/slim/Slim/Handlers/Strategies/RequestResponse.php(38): Espo\Core\Api\Starter->Espo\Core\Api\{closure}(Object(Slim\Psr7\Reques t) , Object(Slim\Psr7\Response), Array) #20 /var/www/html/vendor/slim/slim/Slim/Routing/Route.php(363): Slim\Handlers\Strategies\RequestResponse->__invoke(Object(Closure), Object(Slim\Psr7\Request), Object(Slim\Psr7\Response), Array) #21 /var/www/html/vendor/slim/slim/Slim/MiddlewareDispatcher.php(73): Slim\Routing\Route->handle(Object(Slim\Psr7\Request)) Unminify assets or how to recreate t...o.min.js file? /var/www/html/vendor/slim/slim/Slim/MiddlewareDispatcher.php(73): Slim\MiddlewareDispatcher->handle(Object(Slim\Psr7\Request)) Unminify assets or how to recreate t...o.min.js file? /var/www/html/vendor/slim/slim/Slim/Routing/Route.php(321): Slim\MiddlewareDispatcher->handle(Object(Slim\Psr7\Request)) #24 /var/www/html/vendor/slim/slim/Slim/Routing/RouteRunner.php(74): Slim\Routing\Route->run(Object(Slim\Psr7\Request)) Unminify assets or how to recreate t...o.min.js file? /var/www/html/vendor/slim/slim/Slim/Middleware/RoutingMiddleware.php(45): Slim\Routing\RouteRunner->handle(Object(Slim\Psr7\Request)) how to upgrade ? /var/www/html/vendor/slim/slim/Slim/MiddlewareDispatcher.php(129): Slim\Middleware\RoutingMiddleware->process(Object(Slim\Psr7\Request), Object(Slim\Routing\RouteRunner)) how to upgrade ? /var/www/html/vendor/slim/slim/Slim/Middleware/ErrorMiddleware.php(77): Psr\Http\Server\RequestHandlerInterface@anonymous->handle(Object(Slim\Psr7\Request)) #28 /var/www/html/vendor/slim/slim/Slim/MiddlewareDispatcher.php(129): Slim\Middleware\ErrorMiddleware->process(Object(Slim\Psr7\Request), Object(Psr\Http\Server\RequestHandlerInterface@ano nymous)) #29 /var/www/html/vendor/slim/slim/Slim/MiddlewareDispatcher.php(73): Psr\Http\Server\RequestHandlerInterface@anonymous->handle(Object(Slim\Psr7\Request)) #30 /var/www/html/vendor/slim/slim/Slim/App.php(209): Slim\MiddlewareDispatcher->handle(Object(Slim\Psr7\Request)) #31 /var/www/html/vendor/slim/slim/Slim/App.php(193): Slim\App->handle(Object(Slim\Psr7\Request)) Unminify assets or how to recreate t...o.min.js file? /var/www/html/application/Espo/Core/Api/Starter.php(84): Slim\App->run() Quotes /var/www/html/application/Espo/Core/ApplicationRunners/Api.php(45): Espo\Core\Api\Starter->start() Quotes /var/www/html/application/Espo/Core/Application/RunnerRunner.php(84): Espo\Core\ApplicationRunners\Api->run() #35 /var/www/html/application/Espo/Core/Application.php(78): Espo\Core\Application\RunnerRunner->run('Espo\\Core\\Appli...', NULL) how to upgrade ? /var/www/html/public/api/v1/index.php(35): Espo\Core\Application->run('Espo\\Core\\Appli...') how to upgrade ? {main} Tips: To display error details in HTTP response set "displayErrorDetails" to true in the ErrorHandler constructor.


    thanks for your help
    Jamie
    Tags: None
    • yuri
      EspoCRM product developer
      • Mar 2014
      • 9383
      #2
      Hi,

      Please create posts in bug reports only when such posts comply with the bug report rules. Otherwise, create in another forum category.

      IMPORTANT. Bug report rules. Read before posting - EspoCRM Open Source Community Forum
      https://forum.espocrm.com/forum/bug-reports/23321-important-bug-report-rules-read-before-posting
      Please read the rules – otherwise your post might get deleted. What is mandatory to provide in bug reports: Explicit unambiguous steps for reproducing the issue. As much detail as possible, in form of a numbered list of actions. Expected and actual behaviors. EspoCRM version number (or extension version number). If your
      If you find EspoCRM good, we would greatly appreciate if you could give the project a star on GitHub. We believe our work truly deserves more recognition. Thanks.

        Comment

        • yuri
          EspoCRM product developer
          • Mar 2014
          • 9383
          #3
          Could not reproduce. Such an error would have been reported many times.
          If you find EspoCRM good, we would greatly appreciate if you could give the project a star on GitHub. We believe our work truly deserves more recognition. Thanks.
            👍 1

            Comment

            • jamie
              Member
              • Aug 2025
              • 61
              #4
              Originally posted by yuri
              Could not reproduce. Such an error would have been reported many times.
              Yeah, I'd imagine it would have. Still, are there any plans to upgrade the package to address the security hole?

              CVE-2025-54370
              https://scout.docker.com/vulnerabilities/id/CVE-2025-54370?s=github&n=phpspreadsheet&ns=phpoffice&t=composer&vr=%3C1.30.0
              View details on CVE-2025-54370, including its impact, common weakness enumeration, severity scores, and more from a library of trusted sources.

                Comment

                • yuri
                  EspoCRM product developer
                  • Mar 2014
                  • 9383
                  #5
                  A security vulnerability in a lib in most cases does not lead to a security vulnerability in Espo. If we don't use the impacted feature. It's such a case. In such cases we upgrade the library in the next minor release. You can look up the composer.json and lock files in the GitHub repository to check whether a particular library is already upgraded. This library has been upgraded in the master branch.
                  If you find EspoCRM good, we would greatly appreciate if you could give the project a star on GitHub. We believe our work truly deserves more recognition. Thanks.

                    Comment

                    • jamie
                      Member
                      • Aug 2025
                      • 61
                      #6
                      Originally posted by yuri
                      A security vulnerability in a lib in most cases does not lead to a security vulnerability in Espo. If we don't use the impacted feature. It's such a case. In such cases we upgrade the library in the next minor release. You can look up the composer.json and lock files in the GitHub repository to check whether a particular library is already upgraded. This library has been upgraded in the master branch.
                      Sweet thanks, its just for our iso regulations to have no major security warnings, when do you think the next minor release is coming?

                        Comment

                        • jamie
                          Member
                          • Aug 2025
                          • 61
                          #7
                          Seems it was files missing from the composer auto load, running composer update fixed

                            Comment

                            Previous template Next
                            Working...