PhpSpreadsheet's HTML writer skips htmlspecialchars escaping when a cell's formatted value differs from the original due to custom number formats containing the '@' placeholder plus extra literal characters. This causes the formatted value to bypass HTML escaping, enabling stored cross-site scripting if an attacker controls the cell value and number format in an uploaded spreadsheet that is later converted to HTML and displayed. The vulnerability affects versions from 1.30.3 and earlier up to 5.6.0, with fixed versions released starting at 5.7.0 and corresponding updates in earlier branches.

Successful exploitation allows an attacker to inject and execute arbitrary scripts in the context of users viewing the converted HTML spreadsheet, potentially leading to information disclosure or session hijacking. The CVSS 3.1 base score is 5.4 (medium), reflecting network attack vector, low attack complexity, low privileges required, user interaction needed, and partial impact on confidentiality and integrity but no impact on availability.

Fixed versions are available starting at PhpSpreadsheet 5.7.0 and corresponding updates in earlier branches (3.10.5, 2.4.5, 2.1.16, 1.30.4). Users should upgrade to these versions to remediate the vulnerability. Patch status is not explicitly confirmed in the provided data; therefore, users should consult the official vendor advisory for the latest remediation guidance and confirm patch availability before deployment.