Skip to content
OpenAdvisories

Product · PHPOffice

PhpSpreadsheet

32 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.4
    CVE-2026-108360 Public exploit

    PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading

    PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Worksheet\Drawing::setPath validates only the initial external-image URL with setIsWhitelisted when setAllowExternalImages is e…

    PHPOffice PhpSpreadsheet phpoffice/phpspreadsheet Packagist
  • Medium 5.1
    CVE-2025-22131 Public exploit

    Cross-Site Scripting (XSS) vulnerability in generateNavigation() function

    PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Cross-Site Scripting (XSS) vulnerability in the code which translates the XLSX file into a HTML representation and displays it in the response.

    PHPOffice PhpSpreadsheet phpoffice/phpspreadsheet phpoffice/phpexcel Packagist