Skip to content
OpenAdvisories

Product · PHPOffice

PhpSpreadsheet

32 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.4
    CVE-2026-108360 Public exploit

    PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading

    PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Worksheet\Drawing::setPath validates only the initial external-image URL with setIsWhitelisted when setAllowExternalImages is e…

    PHPOffice PhpSpreadsheet phpoffice/phpspreadsheet Packagist
  • Critical 9.2
    CVE-2026-45034 Public exploit

    PhpSpreadsheet: File::prohibitWrappers bypass

    PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.5, CVE-2026-34084 was patched by the helper File::prohibitWrappers. The helper calls parse_url($filename, PHP_URL_SCHEME) and then checks is_string($scheme) && strle…

    PHPOffice PhpSpreadsheet phpoffice/phpspreadsheet Packagist
  • Medium 5.1
    CVE-2025-22131 Public exploit

    Cross-Site Scripting (XSS) vulnerability in generateNavigation() function

    PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Cross-Site Scripting (XSS) vulnerability in the code which translates the XLSX file into a HTML representation and displays it in the response.

    PHPOffice PhpSpreadsheet phpoffice/phpspreadsheet phpoffice/phpexcel Packagist