Vulnerabilities

TI-2026-79411 CVE-2026-108357 · GHSA-rxj4-h86g-25gc

PhpSpreadsheet XML scanner bypass allows XXE and denial of service

MEDIUM 44

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00463 Published 2026-10-22 Fixed in 3.10.8, 5.10.0 CWE-611

TI-2026-79412 CVE-2026-108359 · GHSA-j2w7-387v-m2rq

PhpSpreadsheet ODS reader exhausts CPU and memory via repeated rows

HIGH 77

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0066 Published 2026-10-22 Fixed in 1.30.7, 2.1.19 +3 CWE-400

TI-2026-79332 CVE-2026-108358 · GHSA-3x94-m842-937c

PhpSpreadsheet XML scanner bypass allows XXE and denial of service

MEDIUM 45

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00625 Published 2026-10-22 Fixed in 1.30.7, 2.1.19 +3 CWE-611

TI-2026-79333 CVE-2026-108360 · GHSA-2phh-27fw-q4gc

PhpSpreadsheet SSRF allowlist bypass via unchecked HTTP redirect

MEDIUM 62

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00339 Published 2026-10-22 Fixed in 1.30.7, 2.1.19 +3 CWE-863

TI-2026-78785 CVE-2026-114404 · GHSA-9prg-2pw9-j2rf

Cross-site scripting in PHPPresentation HTML writer

LOW 30

PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00258 Published 2026-10-21 No fix listed CWE-79

TI-2026-78784 CVE-2026-114403 · GHSA-q73p-x2mp-8gm9

Insecure deserialization in PHPOffice PHPPresentation allows code execution

HIGH 75

PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00703 Published 2026-10-21 No fix listed CWE-502

TI-2026-42740 CVE-2026-59932 · GHSA-2mrg-gjxq-2gvr

PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion

HIGH 72

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00461 Published 2026-07-28 Fixed in 5.8.1, 3.10.7 +3 CWE-400

TI-2026-42741 CVE-2026-59933 · GHSA-xh5m-36r6-47m3

PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion

HIGH 72

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00461 Published 2026-07-28 Fixed in 5.8.1, 3.10.7 +3 CWE-400

TI-2026-42739 CVE-2026-59931 · GHSA-6hq5-7373-42rg

PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist

HIGH 67

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00474 Published 2026-07-28 Fixed in 5.8.1, 3.10.7 +3 CWE-918

TI-2026-32885 CVE-2026-45034 · GHSA-87m4-826x-3crx

PhpSpreadsheet: File::prohibitWrappers bypass

HIGH 81

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00462 Published 2026-06-22 Fixed in 1.30.5 CWE-502

TI-2026-29519 CVE-2026-40863 · GHSA-84wq-86v6-x5j6

PhpSpreadsheet: CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader

HIGH 72

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00395 Published 2026-05-12 Fixed in 1.30.4, 2.1.16 +4 CWE-770

TI-2026-29558 CVE-2026-40902 · GHSA-7c6m-4442-2x6m

PhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions

HIGH 72

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00395 Published 2026-05-12 Fixed in 1.30.4, 2.1.16 +3 CWE-770

TI-2026-29076 CVE-2026-40296 · GHSA-hrmw-qprp-wgmc

PhpSpreadsheet vulnerable to XSS in HTML writer via custom number format codes

MEDIUM 58

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00225 Published 2026-05-06 Fixed in 5.7.0, 3.10.5 +3 CWE-79

TI-2026-27584 CVE-2026-35453 · GHSA-6wpp-88cp-7q68

PhpSpreadsheet XSS via number format text substitution in HTML Writer

MEDIUM 55

PhpSpreadsheet is a library for reading and writing spreadsheet files.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00202 Published 2026-05-05 Fixed in 5.7.0, 3.10.5 +3 CWE-79

TI-2026-26406 CVE-2026-34084 · GHSA-q4q6-r8wh-5cgh

PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load

HIGH 81

PhpSpreadsheet is a library for reading and writing spreadsheet files.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00712 Published 2026-05-05 Fixed in 5.6.0, 3.10.4 +3 CWE-502

TI-2025-34182 CVE-2025-54370 · GHSA-rx7m-68vc-ppxh

PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser

HIGH 77

PhpOffice/PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00817 Published 2025-08-25 Fixed in 1.30.0, 2.1.12 +3 CWE-918

TI-2025-31032 CVE-2025-48882 · GHSA-42hm-pq2f-3r7m

PHPOffice Math allows XXE when processing an XML file in the MathML format

HIGH 71

PHPOffice Math is a library that provides a set of classes to manipulate different formula file formats.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00496 Published 2025-05-30 Fixed in 0.3.0 CWE-611

TI-2025-16995 CVE-2025-23210 · GHSA-r57h-547h-w24f

Bypass XSS sanitizer using the javascript protocol and special characters in phpoffice/phpspreadsheet

LOW 22

phpoffice/phpspreadsheet is a pure PHP library for reading and writing spreadsheet files.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00415 Published 2025-02-03 Fixed in 3.9.0, 2.3.7 +2 CWE-79

TI-2025-16080 CVE-2025-22131 · GHSA-79xx-vf93-p7cx

Cross-Site Scripting (XSS) vulnerability in generateNavigation() function

MEDIUM 56

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00396 Published 2025-01-20 Fixed in 3.8.0, 2.3.6 +2 CWE-79

TI-2024-37342 CVE-2024-56412 · GHSA-q9jv-mm3r-j47r

PhpSpreadsheet vulnerable to bypass of the XSS sanitizer using the javascript protocol and special characters

MEDIUM 55

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.0039 Published 2025-01-03 Fixed in 3.7.0, 1.29.7 +2 CWE-79

TI-2024-37341 CVE-2024-56411 · GHSA-hwcp-2h35-p66w

PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header

MEDIUM 55

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00369 Published 2025-01-03 Fixed in 3.7.0, 1.29.7 +2 CWE-79

TI-2024-37340 CVE-2024-56410 · GHSA-wv23-996v-q229

PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability in custom properties

MEDIUM 55

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00337 Published 2025-01-03 Fixed in 3.7.0, 1.29.7 +2 CWE-79

TI-2024-37339 CVE-2024-56409 · GHSA-j2xg-cjcx-4677

PhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php file

HIGH 75

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.

CVSS 4.0HIGH 8.3 Network No auth User interaction EPSS 0.0034 Published 2025-01-03 Fixed in 3.7.0, 1.29.7 +2 CWE-79

TI-2024-37325 CVE-2024-56366 · GHSA-c6fv-7vh8-2rhr

PhpSpreadsheet vulnerable to unauthorized reflected XSS in the Accounting.php file

HIGH 75

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.

CVSS 4.0HIGH 8.3 Network No auth User interaction EPSS 0.0034 Published 2025-01-03 Fixed in 3.7.0, 1.29.7 +2 CWE-79

TI-2024-37324 CVE-2024-56365 · GHSA-jmpx-686v-c3wx

PhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader class

HIGH 75

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.

CVSS 4.0HIGH 8.3 Network No auth User interaction EPSS 0.00332 Published 2025-01-03 Fixed in 3.7.0, 1.29.7 +2 CWE-79

Vulnerabilities

Filters