PHPOffice

Records38All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high24CVSS 7.0–8.9

Exploited now

PHPOffice records in CISA KEV

No PHPOffice vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Phpspreadsheet 25 records HIGH

Records

25 records in Phpspreadsheet · all components

TI-2026-26406 CVE-2026-34084 · GHSA-q4q6-r8wh-5cgh

PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load

HIGH 81

PhpSpreadsheet is a library for reading and writing spreadsheet files.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00712 Published 2026-05-05 Fixed in 5.6.0, 3.10.4 +3 CWE-502

TI-2024-37339 CVE-2024-56409 · GHSA-j2xg-cjcx-4677

PhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php file

HIGH 75

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.

CVSS 4.0HIGH 8.3 Network No auth User interaction EPSS 0.0034 Published 2025-01-03 Fixed in 3.7.0, 1.29.7 +2 CWE-79

TI-2024-37338 CVE-2024-56408 · GHSA-x88g-h956-m5xg

PhpSpreadsheet allows unauthorized reflected XSS in `Convert-Online.php` file

HIGH 75

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.

CVSS 4.0HIGH 8.3 Network No auth User interaction EPSS 0.00414 Published 2025-01-03 Fixed in 3.7.0, 1.29.7 +2 CWE-79

TI-2024-37325 CVE-2024-56366 · GHSA-c6fv-7vh8-2rhr

PhpSpreadsheet vulnerable to unauthorized reflected XSS in the Accounting.php file

HIGH 75

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.

CVSS 4.0HIGH 8.3 Network No auth User interaction EPSS 0.0034 Published 2025-01-03 Fixed in 3.7.0, 1.29.7 +2 CWE-79

TI-2024-37324 CVE-2024-56365 · GHSA-jmpx-686v-c3wx

PhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader class

HIGH 75

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.

CVSS 4.0HIGH 8.3 Network No auth User interaction EPSS 0.00332 Published 2025-01-03 Fixed in 3.7.0, 1.29.7 +2 CWE-79

TI-2024-30160 CVE-2024-45048 · GHSA-ghg6-32f9-2jp7

XML External Entity Reference (XXE) in PHPSpreadsheet

HIGH 73

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00605 Published 2024-08-28 Fixed in 2.2.1, 1.29.1 +1 CWE-611

TI-2026-29558 CVE-2026-40902 · GHSA-7c6m-4442-2x6m

PhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions

HIGH 72

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00395 Published 2026-05-12 Fixed in 1.30.4, 2.1.16 +3 CWE-770

TI-2026-29519 CVE-2026-40863 · GHSA-84wq-86v6-x5j6

PhpSpreadsheet: CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader

HIGH 72

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00395 Published 2026-05-12 Fixed in 1.30.4, 2.1.16 +4 CWE-770

TI-2024-32127 CVE-2024-47873 · GHSA-jw4x-v69f-hh5w

PhpSpreadsheet XmlScanner bypass leads to XXE

HIGH 72

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0076 Published 2024-11-18 Fixed in 1.29.4, 2.1.3 +2 CWE-611

TI-2024-30365 CVE-2024-45293 · GHSA-6hwr-6v2f-3m88

XML External Entity Reference (XXE) in PHPSpreadsheet's XLSX reader

HIGH 72

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02776 Published 2024-10-07 Fixed in 2.3.0, 1.29.1 +1 CWE-611

TI-2024-30363 CVE-2024-45291 · GHSA-w9xv-qf98-ccq4

Path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled in PHPSpreadsheet

HIGH 71

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00864 Published 2024-10-07 Fixed in 1.29.2, 2.1.1 +1 CWE-36

TI-2024-30362 CVE-2024-45290 · GHSA-5gpr-w2p5-6m37

Path traversal and Server-Side Request Forgery when opening XLSX files in PHPSpreadsheet

HIGH 67

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00625 Published 2024-10-07 Fixed in 1.29.2, 2.1.1 +1 CWE-36

TI-2024-30171 CVE-2024-45060 · GHSA-v66g-p9x6-v98p

Unauthenticated Cross-Site-Scripting (XSS) in sample file in PHPSpreadsheet

MEDIUM 64

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00507 Published 2024-10-07 Fixed in 1.29.2, 2.1.1 +1 CWE-79

TI-2026-29076 CVE-2026-40296 · GHSA-hrmw-qprp-wgmc

PhpSpreadsheet vulnerable to XSS in HTML writer via custom number format codes

MEDIUM 58

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00225 Published 2026-05-06 Fixed in 5.7.0, 3.10.5 +3 CWE-79

TI-2024-30364 CVE-2024-45292 · GHSA-r8w8-74ww-j4wh

PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks

MEDIUM 58

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00344 Published 2024-10-07 Fixed in 1.29.2, 2.1.1 +1 CWE-79

TI-2024-30158 CVE-2024-45046 · GHSA-wgmf-q9vr-vww6

PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information

MEDIUM 58

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00418 Published 2024-08-28 Fixed in 2.1.0, 1.29.1 CWE-79

TI-2025-16080 CVE-2025-22131 · GHSA-79xx-vf93-p7cx

Cross-Site Scripting (XSS) vulnerability in generateNavigation() function

MEDIUM 56

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00396 Published 2025-01-20 Fixed in 3.8.0, 2.3.6 +2 CWE-79

TI-2026-27584 CVE-2026-35453 · GHSA-6wpp-88cp-7q68

PhpSpreadsheet XSS via number format text substitution in HTML Writer

MEDIUM 55

PhpSpreadsheet is a library for reading and writing spreadsheet files.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00202 Published 2026-05-05 Fixed in 5.7.0, 3.10.5 +3 CWE-79

TI-2024-37342 CVE-2024-56412 · GHSA-q9jv-mm3r-j47r

PhpSpreadsheet vulnerable to bypass of the XSS sanitizer using the javascript protocol and special characters

MEDIUM 55

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.0039 Published 2025-01-03 Fixed in 3.7.0, 1.29.7 +2 CWE-79

TI-2024-37341 CVE-2024-56411 · GHSA-hwcp-2h35-p66w

PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header

MEDIUM 55

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00369 Published 2025-01-03 Fixed in 3.7.0, 1.29.7 +2 CWE-79

TI-2024-37340 CVE-2024-56410 · GHSA-wv23-996v-q229

PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability in custom properties

MEDIUM 55

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00337 Published 2025-01-03 Fixed in 3.7.0, 1.29.7 +2 CWE-79

TI-2018-13667 CVE-2018-19277 · GHSA-xcrg-29h7-h4cj

securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection…

MEDIUM 49

securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.07791 Published 2018-11-14 Fixed in 1.5.1, 1.8.2 CWE-91

TI-2019-09194 CVE-2019-12331 · GHSA-vvwv-h69m-wg6f

PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue.

MEDIUM 41

PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0135 Published 2019-11-07 Fixed in 1.8.0 CWE-611

TI-2024-32614 CVE-2024-48917 · GHSA-7cc9-j4mv-vcjp

XXE in PHPSpreadsheet's XLSX reader

MEDIUM 40

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00728 Published 2024-11-18 Fixed in 1.29.4, 2.1.3 +2 CWE-611

TI-2020-06293 CVE-2020-7776 · GHSA-4mqv-gcr3-pff9

Cross-site scripting (XSS) in phpoffice/phpspreadsheet

LOW 34

This affects the package phpoffice/phpspreadsheet from 0.0.0.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.01317 Published 2020-12-09 Fixed in 1.16.0 CWE-79

Open these records in search →

Critical	3
High	24
Medium	11
Low	0
No CVSS	0