PH
Product
PhpSpreadsheet
35
CVEs
0
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 2High 16Medium 17Low 0
Watch
Add PhpSpreadsheet to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-34084 | 9.8 | May 5 | PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load Affected: >= 4.0.0, <= 5.5.0; >= 3.3.0, <= 3.10.3; >= 2.2.0, <= 2.4.3; >= 2.0.0, <= 2.1.14; <= 1.30.2 |
| CVE-2026-45034 | 9.2 | Jun 22 | PhpSpreadsheet: File::prohibitWrappers bypass Affected: < 1.30.5 |
| CVE-2026-108357 | 8.8 | Oct 22 | PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service Affected: >= 3.3.0, < 3.10.8; >= 4.0.0, < 5.10.0 |
| CVE-2026-108358 | 8.8 | Oct 22 | PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service Affected: < 1.30.7; >= 2.0.0, < 2.1.19; >= 2.2.0, < 2.4.8; >= 3.3.0, < 3.10.8; >= 4.0.0, < 5.10.0 |
| CVE-2024-45291 | 8.8 | Oct 7 | Path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled in PHPSpreadsheet Affected: < 1.29.2; >= 2.0.0, < 2.1.1; >= 2.2.0, < 2.3.0 |
| CVE-2019-12331 | 8.8 | Nov 7 | PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue Affected: before 1.8.0 |
| CVE-2018-19277 | 8.8 | Nov 14 | securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file Affected: through 1.5.0 |
| CVE-2026-108359 | 8.7 | Oct 22 | PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS) Affected: < 1.30.7; >= 2.0.0, < 2.1.19; >= 2.2.0, < 2.4.8; >= 3.3.0, < 3.10.8; >= 4.0.0, < 5.10.0 |
| CVE-2025-54370 | 8.7 | Aug 25 | PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser Affected: < 1.30.0; >= 2.0.0, < 2.1.12; >= 2.2.0, < 2.4.0; >= 3.0.0, < 3.10.0; >= 4.0.0, < 5.0.0 |
| CVE-2026-59931 | 7.7 | Jul 28 | PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist Affected: >= 4.0.0, < 5.8.1; >= 3.3.0, < 3.10.7; >= 2.2.0, < 2.4.7; >= 2.0.0, < 2.1.18; < 1.30.6 |
| CVE-2026-59932 | 7.5 | Jul 28 | PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion Affected: >= 4.0.0, < 5.8.1; >= 3.3.0, < 3.10.7; >= 2.2.0, < 2.4.7; >= 2.0.0, < 2.1.18; < 1.30.6 |
| CVE-2026-59933 | 7.5 | Jul 28 | PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion Affected: >= 4.0.0, < 5.8.1; >= 3.3.0, < 3.10.7; >= 2.2.0, < 2.4.7; >= 2.0.0, < 2.1.18; < 1.30.6 |
| CVE-2026-40863 | 7.5 | May 12 | PhpSpreadsheet: CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader Affected: < 1.30.4; >= 2.0.0, < 2.1.16; >= 2.2.0, < 2.4.5; >= 3.3.0, < 3.10.5; >= 4.0.0, < 5.7.0 |
| CVE-2026-40902 | 7.5 | May 12 | PhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions Affected: < 1.30.4; >= 2.0.0, < 2.1.16; >= 2.2.0, < 2.4.5; >= 3.3.0, < 3.10.5; >= 4.0.0, < 5.7.0 |
| CVE-2024-48917 | 7.5 | Nov 18 | XXE in PHPSpreadsheet's XLSX reader Affected: < 1.29.4; >= 2.0.0, < 2.1.3; >= 2.2.0, < 2.3.2; >= 3.3.0, < 3.4.0 |
| CVE-2024-47873 | 7.5 | Nov 18 | PhpSpreadsheet XmlScanner bypass leads to XXE Affected: < 1.29.4; >= 2.0.0, < 2.1.3; >= 2.2.0, < 2.3.2; >= 3.3.0, < 3.4.0 |
| CVE-2024-45290 | 7.5 | Oct 7 | Path traversal and Server-Side Request Forgery when opening XLSX files in PHPSpreadsheet Affected: < 1.29.2; >= 2.0.0, < 2.1.1; >= 2.2.0, < 2.3.0 |
| CVE-2024-45293 | 7.5 | Oct 7 | XML External Entity Reference (XXE) in PHPSpreadsheet's XLSX reader Affected: >= 2.2.0, < 2.3.0; < 1.29.1; >= 2.0.0, < 2.1.1 |
| CVE-2024-45048 | 6.5 | Aug 28 | XML External Entity Reference (XXE) in PHPSpreadsheet Affected: < 2.2.1 |
| CVE-2026-108360 | 6.4 | Oct 22 | PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading Affected: < 1.30.7; >= 2.0.0, < 2.1.19; >= 2.2.0, < 2.4.8; >= 3.3.0, < 3.10.8; >= 4.0.0, < 5.10.0 |
| CVE-2020-7776 | 6.4 | Dec 9 | This affects the package phpoffice/phpspreadsheet from 0.0.0 Affected: before 1.16.0 |
| CVE-2025-22131 | 6.1 | Jan 20 | Cross-Site Scripting (XSS) vulnerability in generateNavigation() function Affected: >= 3.0.0, < 3.8.0; >= 2.2.0, < 2.3.6; >= 2.0.0, < 2.1.7; < 1.29.8 |
| CVE-2024-45060 | 6.1 | Oct 7 | Unauthenticated Cross-Site-Scripting (XSS) in sample file in PHPSpreadsheet Affected: < 1.29.2; >= 2.0.0, < 2.1.1; >= 2.2.0, < 2.3.0 |
| CVE-2026-40296 | 5.4 | May 6 | PhpSpreadsheet vulnerable to XSS in HTML writer via custom number format codes Affected: >= 4.0.0, <= 5.6.0; >= 3.3.0, <= 3.10.4; >= 2.2.0, <= 2.4.4; >= 2.0.0, <= 2.1.15; <= 1.30.3 |
| CVE-2026-35453 | 5.4 | May 5 | PhpSpreadsheet XSS via number format text substitution in HTML Writer Affected: >= 4.0.0, <= 5.6.0; >= 3.3.0, <= 3.10.4; >= 2.2.0, <= 2.4.4; >= 2.0.0, <= 2.1.15; <= 1.30.3 |
| CVE-2024-56412 | 5.4 | Jan 3 | PhpSpreadsheet vulnerable to bypass of the XSS sanitizer using the javascript protocol and special characters Affected: >= 3.0.0, < 3.7.0; < 1.29.7; >= 2.0.0, < 2.1.6; >= 2.2.0, < 2.3.5 |
| CVE-2024-56411 | 5.4 | Jan 3 | PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header Affected: >= 3.0.0, < 3.7.0; < 1.29.7; >= 2.0.0, < 2.1.6; >= 2.2.0, < 2.3.5 |
| CVE-2024-56410 | 5.4 | Jan 3 | PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability in custom properties Affected: >= 3.0.0, < 3.7.0; < 1.29.7; >= 2.0.0, < 2.1.6; >= 2.2.0, < 2.3.5 |
| CVE-2024-56409 | 5.4 | Jan 3 | PhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php file Affected: >= 3.0.0, < 3.7.0; < 1.29.7; >= 2.0.0, < 2.1.6; >= 2.2.0, < 2.3.5 |
| CVE-2024-56366 | 5.4 | Jan 3 | PhpSpreadsheet vulnerable to unauthorized reflected XSS in the Accounting.php file Affected: >= 3.0.0, < 3.7.0; < 1.29.7; >= 2.0.0, < 2.1.6; >= 2.2.0, < 2.3.5 |
| CVE-2024-56365 | 5.4 | Jan 3 | PhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader class Affected: >= 3.0.0, < 3.7.0; < 1.29.7; >= 2.0.0, < 2.1.6; >= 2.2.0, < 2.3.5 |
| CVE-2024-56408 | 5.4 | Jan 3 | PhpSpreadsheet allows unauthorized reflected XSS in `Convert-Online.php` file Affected: >= 3.0.0, < 3.7.0; < 1.29.7; >= 2.0.0, < 2.1.6; >= 2.2.0, < 2.3.5 |
| CVE-2024-45292 | 5.4 | Oct 7 | PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks Affected: < 1.29.2; >= 2.0.0, < 2.1.1; >= 2.2.0, < 2.3.0 |
| CVE-2024-45046 | 5.4 | Aug 28 | PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information Affected: < 2.1.0 |
| CVE-2025-23210 | 4.8 | Feb 3 | Bypass XSS sanitizer using the javascript protocol and special characters in phpoffice/phpspreadsheet Affected: >= 3.0.0, < 3.9.0; >= 2.2.0, < 2.3.7; >= 2.0.0, < 2.1.8; < 1.29.9 |
Showing 35