p PatchFirst

PatchFirst · Latest vulnerabilities

phpoffice/phpspreadsheet vulnerabilities

Vulnerabilities published for phpoffice/phpspreadsheet in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 31

  1. CVE-2026-59932

    High · CVSS 7.5EPSS 0.7%Fix available

    PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion

    PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the Gnumeric reader reads attacker-supplied .gnumeric files into memory and, when the file starts with gzip magic bytes, calls gzdecode() on the full compressed contents without enforcing a decompressed-size limit. A very small compressed .gnumeric file can expand to data larger than the PHP memory limit and crash the process during Gnumeric::canRead() before the file is rejected or fully parsed. This is reachable through n

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Update to 1.30.6
    • Update to 2.1.18
    • Update to 2.4.7
    • Update to 3.10.7
    • Update to 5.8.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2026-59933

    High · CVSS 7.5EPSS 0.7%Fix available

    PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion

    PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A tiny malformed .xls/OLE file can set the small-block depot sector chain to point back to itself. During normal XLS detection, OLERead::read() appends the same sector data repeatedly until the PHP process exhausts memory. This is reachable from Reader\Xls::canRead() and therefore from

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Update to 1.30.6
    • Update to 2.1.18
    • Update to 2.4.7
    • Update to 3.10.7
    • Update to 5.8.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2026-59931

    High · CVSS 7.7EPSS 0.53%Fix available

    PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist

    PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE() domain whitelist can be bypassed via an HTTP redirect (SSRF). In Calculation/Web/Service.php, the webService() method validates a URL's host against the whitelist set via Spreadsheet::setDomainWhiteList(), then fetches content with file_get_contents($url, false, $ctx); because PHP's HTTP stream wrapper follows 301/302 redirects automatically (up to 20 hops) and the redirect target is never re-validated, an

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Update to 1.30.6
    • Update to 2.1.18
    • Update to 2.4.7
    • Update to 3.10.7
    • Update to 5.8.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. CVE-2026-45034

    Critical · CVSS 9.2EPSS 0.46%Fix available

    PhpSpreadsheet: File::prohibitWrappers bypass

    PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.5, CVE-2026-34084 was patched by the helper File::prohibitWrappers. The helper calls parse_url($filename, PHP_URL_SCHEME) and then checks is_string($scheme) && strlen($scheme) > 1 to reject stream wrappers such as phar://, php://, data:// or expect://. The check is not equivalent to "does the path contain a wrapper". When the input has the form phar:///path/file.phar/inner with three or more slashes after the scheme, parse_url returns boolean false instead of returning the scheme string. The is_string($scheme) branch is therefore skipped, the helper

    phpoffice/phpspreadsheetPHP
    • Update to 1.30.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  5. CVE-2026-40863

    High · CVSS 7.5EPSS 0.49%Fix available

    PhpSpreadsheet: CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader

    PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the SpreadsheetML XML reader (Reader\Xml) does not validate the ss:Index row attribute against the maximum allowed row count (AddressRange::MAX_ROW = 1,048,576). An attacker can craft a SpreadsheetML XML file with ss:Index="999999999" on a <Row> element, which inflates the internal cachedHighestRow to ~1 billion. Any subsequent call to getRowIterator() without an explicit end row will attempt to iterate ~1 billion rows, causing CPU exhaustion and denial of service. This vulnerability is fixed in 1.30.4, 2.1.16, 2.

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Update to 1.30.4
    • Update to 2.1.16
    • Update to 2.4.5
    • Update to 3.10.5
    • Update to 5.7.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  6. CVE-2026-40902

    High · CVSS 7.5EPSS 0.49%Fix available

    PhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions

    PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the XLSX reader's ColumnAndRowAttributes::readRowAttributes() method reads row numbers from XML attributes without validating them against the spreadsheet maximum row limit (AddressRange::MAX_ROW = 1,048,576). An attacker can craft a minimal XLSX file (~1.6KB) containing a <row r="999999999"/> element that inflates cachedHighestRow to 999,999,999, causing any subsequent row iteration to attempt ~1 billion loop cycles and exhaust CPU resources. This vulnerability is fixed in 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Update to 1.30.4
    • Update to 2.1.16
    • Update to 2.4.5
    • Update to 3.10.5
    • Update to 5.7.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  7. CVE-2026-40296

    Medium · CVSS 5.4EPSS 0.25%Fix available

    PhpSpreadsheet vulnerable to XSS in HTML writer via custom number format codes

    PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The HTML writer skips htmlspecialchars escaping when a cell's formatted value differs from the original value. When a cell has a custom number format containing the text placeholder @ along with any additional literal characters (for example ". @", "@ ", or "x@"), the formatter replaces @ with the cell value and adds the extra characters, causing the formatted value to differ from the original and bypassing HTML escaping entirely. An attacker who can control the cell value and number format of an uploaded spreadsheet that is later converted to HTML and displayed t

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Update to 1.30.4
    • Update to 2.1.16
    • Update to 2.4.5
    • Update to 3.10.5
    • Update to 5.7.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  8. CVE-2026-35453

    Medium · CVSS 4.8EPSS 0.24%Fix available

    PhpSpreadsheet XSS via number format text substitution in HTML Writer

    PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.3 and earlier, 2.0.0 through 2.1.15, 2.2.0 through 2.4.4, 3.3.0 through 3.10.4, and 4.0.0 through 5.6.0, the HTML Writer skips htmlspecialchars() output escaping when a cell uses a custom number format containing the @ text placeholder with additional literal text (e.g., @ "items"). The escaping is only applied when the formatted output strictly equals the original cell value. When the format code contains @ with quoted literal text, the formatter substitutes the raw cell value into the format string and returns early without invoking the escaping callback

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Update to 1.30.4
    • Update to 2.1.16
    • Update to 2.4.5
    • Update to 3.10.5
    • Update to 5.7.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  9. CVE-2026-34084

    Critical · CVSS 9.2EPSS 0.78%Fix available

    PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load

    PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.2 and earlier, 2.0.0 through 2.1.14, 2.2.0 through 2.4.3, 3.3.0 through 3.10.3, and 4.0.0 through 5.5.0, when the filename argument to IOFactory::load() is user-controlled, an attacker can supply a PHP stream wrapper path (such as phar://, ftp://, or ssh2.sftp://) that passes the is_file() check in File::assertFile(). The phar:// wrapper triggers deserialization of the PHAR metadata, which can lead to remote code execution if a suitable gadget chain is available in the application. The ftp:// and ssh2.sftp:// wrappers can be used for server-side request fo

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Update to 1.30.3
    • Update to 2.1.15
    • Update to 2.4.4
    • Update to 3.10.4
    • Update to 5.6.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  10. CVE-2025-54370

    High · CVSS 8.7EPSS 0.83%Fix available

    PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser

    PhpOffice/PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to versions 1.30.0, 2.1.12, 2.4.0, 3.10.0, and 5.0.0, SSRF can occur when a processed HTML document is read and displayed in the browser. The vulnerability lies in the setPath method of the PhpOffice\PhpSpreadsheet\Worksheet\Drawing class, where a crafted string from the user is passed to the HTML reader. This issue has been patched in versions 1.30.0, 2.1.12, 2.4.0, 3.10.0, and 5.0.0.

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Update to 1.30.0
    • Update to 2.1.12
    • Update to 2.4.0
    • Update to 3.10.0
    • Update to 5.0.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  11. CVE-2025-23210

    Medium · CVSS 4.8EPSS 0.41%Fix available

    Bypass XSS sanitizer using the javascript protocol and special characters in phpoffice/phpspreadsheet

    phpoffice/phpspreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions have been found to have a Bypass of the Cross-site Scripting (XSS) sanitizer using the javascript protocol and special characters. This issue has been addressed in versions 3.9.0, 2.3.7, 2.1.8, and 1.29.9. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Update to 1.29.9
    • Update to 2.1.8
    • Update to 2.3.7
    • Update to 3.9.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  12. CVE-2025-22131

    Medium · CVSS 5.1EPSS 0.4%Public exploitFix available

    Cross-Site Scripting (XSS) vulnerability in generateNavigation() function

    PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Cross-Site Scripting (XSS) vulnerability in the code which translates the XLSX file into a HTML representation and displays it in the response.

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Update to 1.29.8
    • Update to 2.1.7
    • Update to 2.3.6
    • Update to 3.8.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  13. CVE-2024-56412

    Medium · CVSS 4.8EPSS 0.39%Fix available

    PhpSpreadsheet vulnerable to bypass of the XSS sanitizer using the javascript protocol and special characters

    PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to bypass of the cross-site scripting sanitizer using the javascript protocol and special characters. An attacker can use special characters, so that the library processes the javascript protocol with special characters and generates an HTML link. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Update to 1.29.7
    • Update to 2.1.6
    • Update to 2.3.5
    • Update to 3.7.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  14. CVE-2024-56411

    Medium · CVSS 4.8EPSS 0.37%Fix available

    PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header

    PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have a cross-site scripting (XSS) vulnerability of the hyperlink base in the HTML page header. The HTML page is formed without sanitizing the hyperlink base. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Update to 1.29.7
    • Update to 2.1.6
    • Update to 2.3.5
    • Update to 3.7.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  15. CVE-2024-56410

    Medium · CVSS 4.8EPSS 0.34%Fix available

    PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability in custom properties

    PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have a cross-site scripting (XSS) vulnerability in custom properties. The HTML page is generated without clearing custom properties. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Update to 1.29.7
    • Update to 2.1.6
    • Update to 2.3.5
    • Update to 3.7.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  16. CVE-2024-56409

    High · CVSS 8.3EPSS 0.34%Fix available

    PhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php file

    PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the `Currency.php` file. Using the `/vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Currency.php` script, an attacker can perform a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Update to 1.29.7
    • Update to 2.1.6
    • Update to 2.3.5
    • Update to 3.7.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  17. CVE-2024-56366

    High · CVSS 8.3EPSS 0.34%Fix available

    PhpSpreadsheet vulnerable to unauthorized reflected XSS in the Accounting.php file

    PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the `Accounting.php` file. Using the `/vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Accounting.php` script, an attacker can perform a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Update to 1.29.7
    • Update to 2.1.6
    • Update to 2.3.5
    • Update to 3.7.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  18. CVE-2024-56365

    High · CVSS 8.3EPSS 0.33%Fix available

    PhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader class

    PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the constructor of the `Downloader` class. Using the `/vendor/phpoffice/phpspreadsheet/samples/download.php` script, an attacker can perform a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Update to 1.29.7
    • Update to 2.1.6
    • Update to 2.3.5
    • Update to 3.7.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  19. CVE-2024-56408

    High · CVSS 8.3EPSS 0.41%Fix available

    PhpSpreadsheet allows unauthorized reflected XSS in `Convert-Online.php` file

    PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have no sanitization in the `/vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.php` file, which leads to the possibility of a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Update to 1.29.7
    • Update to 2.1.6
    • Update to 2.3.5
    • Update to 3.7.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  20. CVE-2024-48917

    High · CVSS 7.5EPSS 0.73%Fix available

    XXE in PHPSpreadsheet's XLSX reader

    PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. The `XmlScanner` class has a scan method which should prevent XXE attacks. However, in a bypass of the previously reported `CVE-2024-47873`, the regexes from the `findCharSet` method, which is used for determining the current encoding can be bypassed by using a payload in the encoding UTF-7, and adding at end of the file a comment with the value `encoding="UTF-8"` with `"`, which is matched by the first regex, so that `encoding='UTF-7'` with single quotes `'` in the XML header is not matched by the second regex. An attacker can bypass the sanitizer and achieve an XML e

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Update to 1.29.4
    • Update to 2.1.3
    • Update to 2.3.2
    • Update to 3.4.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →