p PatchFirst

PatchFirst · Свежие уязвимости

Уязвимости phpoffice/phpspreadsheet

За последние 30 дней в phpoffice/phpspreadsheet опубликовано уязвимостей: 0; в каталоге KEV: 0.

RSS ↗
Фильтры уязвимостей
Сбросить фильтры

Уязвимостей: 31

  1. CVE-2026-59932

    Высокий · CVSS 7.5EPSS 0,7%Есть исправление

    PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion

    PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the Gnumeric reader reads attacker-supplied .gnumeric files into memory and, when the file starts with gzip magic bytes, calls gzdecode() on the full compressed contents without enforcing a decompressed-size limit. A very small compressed .gnumeric file can expand to data larger than the PHP memory limit and crash the process during Gnumeric::canRead() before the file is rejected or fully parsed. This is reachable through n

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Обновитесь до 1.30.6
    • Обновитесь до 2.1.18
    • Обновитесь до 2.4.7
    • Обновитесь до 3.10.7
    • Обновитесь до 5.8.1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  2. CVE-2026-59933

    Высокий · CVSS 7.5EPSS 0,7%Есть исправление

    PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion

    PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A tiny malformed .xls/OLE file can set the small-block depot sector chain to point back to itself. During normal XLS detection, OLERead::read() appends the same sector data repeatedly until the PHP process exhausts memory. This is reachable from Reader\Xls::canRead() and therefore from

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Обновитесь до 1.30.6
    • Обновитесь до 2.1.18
    • Обновитесь до 2.4.7
    • Обновитесь до 3.10.7
    • Обновитесь до 5.8.1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  3. CVE-2026-59931

    Высокий · CVSS 7.7EPSS 0,53%Есть исправление

    PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist

    PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE() domain whitelist can be bypassed via an HTTP redirect (SSRF). In Calculation/Web/Service.php, the webService() method validates a URL's host against the whitelist set via Spreadsheet::setDomainWhiteList(), then fetches content with file_get_contents($url, false, $ctx); because PHP's HTTP stream wrapper follows 301/302 redirects automatically (up to 20 hops) and the redirect target is never re-validated, an

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Обновитесь до 1.30.6
    • Обновитесь до 2.1.18
    • Обновитесь до 2.4.7
    • Обновитесь до 3.10.7
    • Обновитесь до 5.8.1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  4. CVE-2026-45034

    Критический · CVSS 9.2EPSS 0,46%Есть исправление

    PhpSpreadsheet: File::prohibitWrappers bypass

    PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.5, CVE-2026-34084 was patched by the helper File::prohibitWrappers. The helper calls parse_url($filename, PHP_URL_SCHEME) and then checks is_string($scheme) && strlen($scheme) > 1 to reject stream wrappers such as phar://, php://, data:// or expect://. The check is not equivalent to "does the path contain a wrapper". When the input has the form phar:///path/file.phar/inner with three or more slashes after the scheme, parse_url returns boolean false instead of returning the scheme string. The is_string($scheme) branch is therefore skipped, the helper

    phpoffice/phpspreadsheetPHP
    • Обновитесь до 1.30.5
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  5. CVE-2026-40863

    Высокий · CVSS 7.5EPSS 0,49%Есть исправление

    PhpSpreadsheet: CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader

    PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the SpreadsheetML XML reader (Reader\Xml) does not validate the ss:Index row attribute against the maximum allowed row count (AddressRange::MAX_ROW = 1,048,576). An attacker can craft a SpreadsheetML XML file with ss:Index="999999999" on a <Row> element, which inflates the internal cachedHighestRow to ~1 billion. Any subsequent call to getRowIterator() without an explicit end row will attempt to iterate ~1 billion rows, causing CPU exhaustion and denial of service. This vulnerability is fixed in 1.30.4, 2.1.16, 2.

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Обновитесь до 1.30.4
    • Обновитесь до 2.1.16
    • Обновитесь до 2.4.5
    • Обновитесь до 3.10.5
    • Обновитесь до 5.7.0
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  6. CVE-2026-40902

    Высокий · CVSS 7.5EPSS 0,49%Есть исправление

    PhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions

    PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the XLSX reader's ColumnAndRowAttributes::readRowAttributes() method reads row numbers from XML attributes without validating them against the spreadsheet maximum row limit (AddressRange::MAX_ROW = 1,048,576). An attacker can craft a minimal XLSX file (~1.6KB) containing a <row r="999999999"/> element that inflates cachedHighestRow to 999,999,999, causing any subsequent row iteration to attempt ~1 billion loop cycles and exhaust CPU resources. This vulnerability is fixed in 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Обновитесь до 1.30.4
    • Обновитесь до 2.1.16
    • Обновитесь до 2.4.5
    • Обновитесь до 3.10.5
    • Обновитесь до 5.7.0
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  7. CVE-2026-40296

    Средний · CVSS 5.4EPSS 0,25%Есть исправление

    PhpSpreadsheet vulnerable to XSS in HTML writer via custom number format codes

    PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The HTML writer skips htmlspecialchars escaping when a cell's formatted value differs from the original value. When a cell has a custom number format containing the text placeholder @ along with any additional literal characters (for example ". @", "@ ", or "x@"), the formatter replaces @ with the cell value and adds the extra characters, causing the formatted value to differ from the original and bypassing HTML escaping entirely. An attacker who can control the cell value and number format of an uploaded spreadsheet that is later converted to HTML and displayed t

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Обновитесь до 1.30.4
    • Обновитесь до 2.1.16
    • Обновитесь до 2.4.5
    • Обновитесь до 3.10.5
    • Обновитесь до 5.7.0
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  8. CVE-2026-35453

    Средний · CVSS 4.8EPSS 0,24%Есть исправление

    PhpSpreadsheet XSS via number format text substitution in HTML Writer

    PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.3 and earlier, 2.0.0 through 2.1.15, 2.2.0 through 2.4.4, 3.3.0 through 3.10.4, and 4.0.0 through 5.6.0, the HTML Writer skips htmlspecialchars() output escaping when a cell uses a custom number format containing the @ text placeholder with additional literal text (e.g., @ "items"). The escaping is only applied when the formatted output strictly equals the original cell value. When the format code contains @ with quoted literal text, the formatter substitutes the raw cell value into the format string and returns early without invoking the escaping callback

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Обновитесь до 1.30.4
    • Обновитесь до 2.1.16
    • Обновитесь до 2.4.5
    • Обновитесь до 3.10.5
    • Обновитесь до 5.7.0
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  9. CVE-2026-34084

    Критический · CVSS 9.2EPSS 0,78%Есть исправление

    PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load

    PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.2 and earlier, 2.0.0 through 2.1.14, 2.2.0 through 2.4.3, 3.3.0 through 3.10.3, and 4.0.0 through 5.5.0, when the filename argument to IOFactory::load() is user-controlled, an attacker can supply a PHP stream wrapper path (such as phar://, ftp://, or ssh2.sftp://) that passes the is_file() check in File::assertFile(). The phar:// wrapper triggers deserialization of the PHAR metadata, which can lead to remote code execution if a suitable gadget chain is available in the application. The ftp:// and ssh2.sftp:// wrappers can be used for server-side request fo

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Обновитесь до 1.30.3
    • Обновитесь до 2.1.15
    • Обновитесь до 2.4.4
    • Обновитесь до 3.10.4
    • Обновитесь до 5.6.0
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  10. CVE-2025-54370

    Высокий · CVSS 8.7EPSS 0,83%Есть исправление

    PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser

    PhpOffice/PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to versions 1.30.0, 2.1.12, 2.4.0, 3.10.0, and 5.0.0, SSRF can occur when a processed HTML document is read and displayed in the browser. The vulnerability lies in the setPath method of the PhpOffice\PhpSpreadsheet\Worksheet\Drawing class, where a crafted string from the user is passed to the HTML reader. This issue has been patched in versions 1.30.0, 2.1.12, 2.4.0, 3.10.0, and 5.0.0.

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Обновитесь до 1.30.0
    • Обновитесь до 2.1.12
    • Обновитесь до 2.4.0
    • Обновитесь до 3.10.0
    • Обновитесь до 5.0.0
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  11. CVE-2025-23210

    Средний · CVSS 4.8EPSS 0,41%Есть исправление

    Bypass XSS sanitizer using the javascript protocol and special characters in phpoffice/phpspreadsheet

    phpoffice/phpspreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions have been found to have a Bypass of the Cross-site Scripting (XSS) sanitizer using the javascript protocol and special characters. This issue has been addressed in versions 3.9.0, 2.3.7, 2.1.8, and 1.29.9. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Обновитесь до 1.29.9
    • Обновитесь до 2.1.8
    • Обновитесь до 2.3.7
    • Обновитесь до 3.9.0
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  12. CVE-2025-22131

    Средний · CVSS 5.1EPSS 0,4%Публичный эксплойтЕсть исправление

    Cross-Site Scripting (XSS) vulnerability in generateNavigation() function

    PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Cross-Site Scripting (XSS) vulnerability in the code which translates the XLSX file into a HTML representation and displays it in the response.

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Обновитесь до 1.29.8
    • Обновитесь до 2.1.7
    • Обновитесь до 2.3.6
    • Обновитесь до 3.8.0
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  13. CVE-2024-56412

    Средний · CVSS 4.8EPSS 0,39%Есть исправление

    PhpSpreadsheet vulnerable to bypass of the XSS sanitizer using the javascript protocol and special characters

    PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to bypass of the cross-site scripting sanitizer using the javascript protocol and special characters. An attacker can use special characters, so that the library processes the javascript protocol with special characters and generates an HTML link. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Обновитесь до 1.29.7
    • Обновитесь до 2.1.6
    • Обновитесь до 2.3.5
    • Обновитесь до 3.7.0
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  14. CVE-2024-56411

    Средний · CVSS 4.8EPSS 0,37%Есть исправление

    PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header

    PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have a cross-site scripting (XSS) vulnerability of the hyperlink base in the HTML page header. The HTML page is formed without sanitizing the hyperlink base. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Обновитесь до 1.29.7
    • Обновитесь до 2.1.6
    • Обновитесь до 2.3.5
    • Обновитесь до 3.7.0
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  15. CVE-2024-56410

    Средний · CVSS 4.8EPSS 0,34%Есть исправление

    PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability in custom properties

    PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have a cross-site scripting (XSS) vulnerability in custom properties. The HTML page is generated without clearing custom properties. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Обновитесь до 1.29.7
    • Обновитесь до 2.1.6
    • Обновитесь до 2.3.5
    • Обновитесь до 3.7.0
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  16. CVE-2024-56409

    Высокий · CVSS 8.3EPSS 0,34%Есть исправление

    PhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php file

    PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the `Currency.php` file. Using the `/vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Currency.php` script, an attacker can perform a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Обновитесь до 1.29.7
    • Обновитесь до 2.1.6
    • Обновитесь до 2.3.5
    • Обновитесь до 3.7.0
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  17. CVE-2024-56366

    Высокий · CVSS 8.3EPSS 0,34%Есть исправление

    PhpSpreadsheet vulnerable to unauthorized reflected XSS in the Accounting.php file

    PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the `Accounting.php` file. Using the `/vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Accounting.php` script, an attacker can perform a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Обновитесь до 1.29.7
    • Обновитесь до 2.1.6
    • Обновитесь до 2.3.5
    • Обновитесь до 3.7.0
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  18. CVE-2024-56365

    Высокий · CVSS 8.3EPSS 0,33%Есть исправление

    PhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader class

    PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the constructor of the `Downloader` class. Using the `/vendor/phpoffice/phpspreadsheet/samples/download.php` script, an attacker can perform a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Обновитесь до 1.29.7
    • Обновитесь до 2.1.6
    • Обновитесь до 2.3.5
    • Обновитесь до 3.7.0
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  19. CVE-2024-56408

    Высокий · CVSS 8.3EPSS 0,41%Есть исправление

    PhpSpreadsheet allows unauthorized reflected XSS in `Convert-Online.php` file

    PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have no sanitization in the `/vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.php` file, which leads to the possibility of a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Обновитесь до 1.29.7
    • Обновитесь до 2.1.6
    • Обновитесь до 2.3.5
    • Обновитесь до 3.7.0
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  20. CVE-2024-48917

    Высокий · CVSS 7.5EPSS 0,73%Есть исправление

    XXE in PHPSpreadsheet's XLSX reader

    PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. The `XmlScanner` class has a scan method which should prevent XXE attacks. However, in a bypass of the previously reported `CVE-2024-47873`, the regexes from the `findCharSet` method, which is used for determining the current encoding can be bypassed by using a payload in the encoding UTF-7, and adding at end of the file a comment with the value `encoding="UTF-8"` with `"`, which is matched by the first regex, so that `encoding='UTF-7'` with single quotes `'` in the XML header is not matched by the second regex. An attacker can bypass the sanitizer and achieve an XML e

    phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheet phpoffice/phpspreadsheetPHP
    • Обновитесь до 1.29.4
    • Обновитесь до 2.1.3
    • Обновитесь до 2.3.2
    • Обновитесь до 3.4.0
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

Проверьте свой сервер

Сопоставьте установленный стек и версии со свежими базами уязвимостей.

Проверьте свой сервер →