PHPOffice

Records38All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high24CVSS 7.0–8.9

Exploited now

PHPOffice records in CISA KEV

No PHPOffice vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Phpspreadsheet 25 records HIGH

Records

38 records

TI-2026-32885 CVE-2026-45034 · GHSA-87m4-826x-3crx

PhpSpreadsheet: File::prohibitWrappers bypass

HIGH 81

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00462 Published 2026-06-22 Fixed in 1.30.5 CWE-502

TI-2026-26406 CVE-2026-34084 · GHSA-q4q6-r8wh-5cgh

PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load

HIGH 81

PhpSpreadsheet is a library for reading and writing spreadsheet files.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00712 Published 2026-05-05 Fixed in 5.6.0, 3.10.4 +3 CWE-502

TI-2026-79412 CVE-2026-108359 · GHSA-j2w7-387v-m2rq

PhpSpreadsheet ODS reader exhausts CPU and memory via repeated rows

HIGH 77

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0066 Published 2026-10-22 Fixed in 1.30.7, 2.1.19 +3 CWE-400

TI-2025-34182 CVE-2025-54370 · GHSA-rx7m-68vc-ppxh

PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser

HIGH 77

PhpOffice/PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00817 Published 2025-08-25 Fixed in 1.30.0, 2.1.12 +3 CWE-918

TI-2026-78784 CVE-2026-114403 · GHSA-q73p-x2mp-8gm9

Insecure deserialization in PHPOffice PHPPresentation allows code execution

HIGH 75

PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00703 Published 2026-10-21 No fix listed CWE-502

TI-2024-37339 CVE-2024-56409 · GHSA-j2xg-cjcx-4677

PhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php file

HIGH 75

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.

CVSS 4.0HIGH 8.3 Network No auth User interaction EPSS 0.0034 Published 2025-01-03 Fixed in 3.7.0, 1.29.7 +2 CWE-79

TI-2024-37338 CVE-2024-56408 · GHSA-x88g-h956-m5xg

PhpSpreadsheet allows unauthorized reflected XSS in `Convert-Online.php` file

HIGH 75

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.

CVSS 4.0HIGH 8.3 Network No auth User interaction EPSS 0.00414 Published 2025-01-03 Fixed in 3.7.0, 1.29.7 +2 CWE-79

TI-2024-37325 CVE-2024-56366 · GHSA-c6fv-7vh8-2rhr

PhpSpreadsheet vulnerable to unauthorized reflected XSS in the Accounting.php file

HIGH 75

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.

CVSS 4.0HIGH 8.3 Network No auth User interaction EPSS 0.0034 Published 2025-01-03 Fixed in 3.7.0, 1.29.7 +2 CWE-79

TI-2024-37324 CVE-2024-56365 · GHSA-jmpx-686v-c3wx

PhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader class

HIGH 75

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.

CVSS 4.0HIGH 8.3 Network No auth User interaction EPSS 0.00332 Published 2025-01-03 Fixed in 3.7.0, 1.29.7 +2 CWE-79

TI-2024-30160 CVE-2024-45048 · GHSA-ghg6-32f9-2jp7

XML External Entity Reference (XXE) in PHPSpreadsheet

HIGH 73

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00605 Published 2024-08-28 Fixed in 2.2.1, 1.29.1 +1 CWE-611

TI-2026-42741 CVE-2026-59933 · GHSA-xh5m-36r6-47m3

PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion

HIGH 72

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00461 Published 2026-07-28 Fixed in 5.8.1, 3.10.7 +3 CWE-400

TI-2026-42740 CVE-2026-59932 · GHSA-2mrg-gjxq-2gvr

PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion

HIGH 72

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00461 Published 2026-07-28 Fixed in 5.8.1, 3.10.7 +3 CWE-400

TI-2026-29558 CVE-2026-40902 · GHSA-7c6m-4442-2x6m

PhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions

HIGH 72

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00395 Published 2026-05-12 Fixed in 1.30.4, 2.1.16 +3 CWE-770

TI-2026-29519 CVE-2026-40863 · GHSA-84wq-86v6-x5j6

PhpSpreadsheet: CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader

HIGH 72

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00395 Published 2026-05-12 Fixed in 1.30.4, 2.1.16 +4 CWE-770

TI-2024-32127 CVE-2024-47873 · GHSA-jw4x-v69f-hh5w

PhpSpreadsheet XmlScanner bypass leads to XXE

HIGH 72

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0076 Published 2024-11-18 Fixed in 1.29.4, 2.1.3 +2 CWE-611

TI-2024-30365 CVE-2024-45293 · GHSA-6hwr-6v2f-3m88

XML External Entity Reference (XXE) in PHPSpreadsheet's XLSX reader

HIGH 72

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02776 Published 2024-10-07 Fixed in 2.3.0, 1.29.1 +1 CWE-611

TI-2025-31032 CVE-2025-48882 · GHSA-42hm-pq2f-3r7m

PHPOffice Math allows XXE when processing an XML file in the MathML format

HIGH 71

PHPOffice Math is a library that provides a set of classes to manipulate different formula file formats.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00496 Published 2025-05-30 Fixed in 0.3.0 CWE-611

TI-2024-30363 CVE-2024-45291 · GHSA-w9xv-qf98-ccq4

Path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled in PHPSpreadsheet

HIGH 71

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00864 Published 2024-10-07 Fixed in 1.29.2, 2.1.1 +1 CWE-36

TI-2026-42739 CVE-2026-59931 · GHSA-6hq5-7373-42rg

PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist

HIGH 67

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00474 Published 2026-07-28 Fixed in 5.8.1, 3.10.7 +3 CWE-918

TI-2024-30362 CVE-2024-45290 · GHSA-5gpr-w2p5-6m37

Path traversal and Server-Side Request Forgery when opening XLSX files in PHPSpreadsheet

HIGH 67

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00625 Published 2024-10-07 Fixed in 1.29.2, 2.1.1 +1 CWE-36

TI-2024-30171 CVE-2024-45060 · GHSA-v66g-p9x6-v98p

Unauthenticated Cross-Site-Scripting (XSS) in sample file in PHPSpreadsheet

MEDIUM 64

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00507 Published 2024-10-07 Fixed in 1.29.2, 2.1.1 +1 CWE-79

TI-2026-79333 CVE-2026-108360 · GHSA-2phh-27fw-q4gc

PhpSpreadsheet SSRF allowlist bypass via unchecked HTTP redirect

MEDIUM 62

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00339 Published 2026-10-22 Fixed in 1.30.7, 2.1.19 +3 CWE-863

TI-2026-29076 CVE-2026-40296 · GHSA-hrmw-qprp-wgmc

PhpSpreadsheet vulnerable to XSS in HTML writer via custom number format codes

MEDIUM 58

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00225 Published 2026-05-06 Fixed in 5.7.0, 3.10.5 +3 CWE-79

TI-2024-30364 CVE-2024-45292 · GHSA-r8w8-74ww-j4wh

PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks

MEDIUM 58

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00344 Published 2024-10-07 Fixed in 1.29.2, 2.1.1 +1 CWE-79

TI-2024-30158 CVE-2024-45046 · GHSA-wgmf-q9vr-vww6

PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information

MEDIUM 58

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00418 Published 2024-08-28 Fixed in 2.1.0, 1.29.1 CWE-79

Open these records in search →

Critical	3
High	24
Medium	11
Low	0
No CVSS	0