Skip to content
OpenAdvisories

Vendor

PHPOffice

35 known vulnerabilities.

Products

PhpSpreadsheet 32 PHPPresentation 2 Math 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.2
    CVE-2026-45034 Public exploit

    PhpSpreadsheet: File::prohibitWrappers bypass

    PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.5, CVE-2026-34084 was patched by the helper File::prohibitWrappers. The helper calls parse_url($filename, PHP_URL_SCHEME) and then checks is_string($scheme) && strle…

    PHPOffice PhpSpreadsheet phpoffice/phpspreadsheet Packagist
  • Critical 9.2
    CVE-2026-34084

    PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load

    PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.2 and earlier, 2.0.0 through 2.1.14, 2.2.0 through 2.4.3, 3.3.0 through 3.10.3, and 4.0.0 through 5.5.0, when the filename argument to IOFactory::load() is user-controlled…

    PHPOffice PhpSpreadsheet phpoffice/phpspreadsheet Packagist