securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file
github.com/FriendsOfPHP/security-advisories/blob/master/phpoffice/phpspreadsheet/CVE-2018-19277.yaml
github.com/MewesK/TwigSpreadsheetBundle/issues/18
github.com/PHPOffice/PhpSpreadsheet
github.com/PHPOffice/PhpSpreadsheet/commit/0f8f071e24ee8b114d894ac172f77dc250e5bfa4
github.com/PHPOffice/PhpSpreadsheet/issues/771
github.com/PHPOffice/PhpSpreadsheet/pull/780
github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.5.1
nvd.nist.gov/vuln/detail/CVE-2018-19277
www.bishopfox.com/news/2018/11/phpoffice-versions
www.drupal.org/sa-contrib-2021-043