securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file
{ "nvd_published_at": "2018-11-14T11:29:00Z", "cwe_ids": [ "CWE-91" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2019-11-19T03:40:52Z" }