PhpSpreadsheet (< 1.29.8, 2.0.0 - 2.3.6, 3.0.0 - 3.8.0)

CVE-2025-22131 is a stored cross-site scripting vulnerability in PHPOffice PhpSpreadsheet caused by improper sanitization of XLSX sheet names in navigation HTML, allowing for session cookie theft.