The vulnerability of the gzfileGetContents() method in the src/PhpSpreadsheet/Reader/Gnumeric.php script of the PhpSpreadsheet library allows a attacker to cause a service failure.

The vulnerability of the gzfileGetContents method in the src/PhpSpreadsheet/Reader/Gnumeric.php script of the PhpSpreadsheet library is related to incorrect processing of highly compressed input data. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-63656

Name of the Vulnerable Software and Affected Versions PhpSpreadsheet affected versions not specified Description The OLE reader in PhpSpreadsheet follows sector chains from XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A malformed file can set the small-block depo...

PT-2026-63654

Name of the Vulnerable Software and Affected Versions PhpSpreadsheet affected versions not specified Description An issue exists in the Gnumeric reader where the gzfileGetContents function in src/PhpSpreadsheet/Reader/Gnumeric.php incorrectly handles highly compressed input data. When a .gnumeric...

PT-2026-63655

Name of the Vulnerable Software and Affected Versions PhpSpreadsheet versions 4.0.0 through 5.8.0 PhpSpreadsheet versions 3.3.0 through 3.10.6 PhpSpreadsheet versions 2.2.0 through 2.4.6 PhpSpreadsheet versions 2.0.0 through 2.1.17 PhpSpreadsheet versions prior to 1.30.6 Description Insufficient...

Deserialization of Untrusted Data

Overview phpoffice/phpspreadsheet is a Spreadsheet engine that Read, Create and Write Spreadsheet documents in PHP . Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the File::prohibitWrappers function. An attacker can execute arbitrary code or read files b...

CVE-2026-45034

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.5, CVE-2026-34084 was patched by the helper File::prohibitWrappers. The helper calls parseurl$filename, PHPURLSCHEME and then checks isstring$scheme && strlen$scheme 1 to reject stream wrappers such as...

CVE-2026-45034

Summary: PhpSpreadsheet before 1.30.5 contains a bypass in File::prohibitWrappers that can be exploited via phar:// wrapper paths (e.g., phar:///path/file.phar/inner). When input contains three or more slashes after the scheme, parse_url can return false, skipping the check and allowing phar wrap...

CVE-2026-45034 PhpSpreadsheet: File::prohibitWrappers bypass

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.5, CVE-2026-34084 was patched by the helper File::prohibitWrappers. The helper calls parseurl$filename, PHPURLSCHEME and then checks isstring$scheme && strlen$scheme 1 to reject stream wrappers such as...

Improper Input Validation

phpoffice/phpspreadsheet is vulnerable to Improper Input Validation. The vulnerability is due to insufficient validation of PHP stream wrappers, where the wrapper check can be bypassed using malformed phar:/// paths, which allows an attacker to exploit the phar stream wrapper to bypass security...

Exploit for CVE-2026-45034

🧨 PHPSpreadsheet Phar Deserialization Exploit Bypass pro...

GHSA-87M4-826X-3CRX PHPSpreadsheet has a patch bypass for CVE-2026-34084

Summary CVE-2026-34084 was patched by the helper File::prohibitWrappers. The helper calls parseurl$filename, PHPURLSCHEME and then checks isstring$scheme && strlen$scheme 1 to reject stream wrappers such as phar://, php://, data:// or expect://. The check is not equivalent to "does the path conta...

PT-2026-47606

Name of the Vulnerable Software and Affected Versions PhpSpreadsheet versions prior to 1.30.5 Description An issue exists in the File::prohibitWrappers function where the use of parse url to detect stream wrappers can be bypassed. When an input contains three or more slashes after the scheme e.g....

CVE-2026-45034

creationtimestamp| type| source ---|---|--- 2026-06-07 04:04:34+00:00| published-proof-of-concept| https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-87m4-826x-3crx 2026-06-11 11:00:12+00:00| published-proof-of-concept| Telegram/bfOUhtYO5knJKojifOKxt7hZq78r0zHfwCUUuIAza2Gk...

CVE-2026-34084

PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.2 and earlier, 2.0.0 through 2.1.14, 2.2.0 through 2.4.3, 3.3.0 through 3.10.3, and 4.0.0 through 5.5.0, when the filename argument to IOFactory::load is user-controlled, an attacker can supply a PHP stream...

CVE-2026-40863

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the SpreadsheetML XML reader Reader\Xml does not validate the ss:Index row attribute against the maximum allowed row count AddressRange::MAXROW = 1,048,576. An attack...

CVE-2026-40902

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the XLSX reader's ColumnAndRowAttributes::readRowAttributes method reads row numbers from XML attributes without validating them against the spreadsheet maximum row...

CVE-2026-40863 PhpSpreadsheet: CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the SpreadsheetML XML reader Reader\Xml does not validate the ss:Index row attribute against the maximum allowed row count AddressRange::MAXROW = 1,048,576. An attack...

CVE-2026-40863 PhpSpreadsheet: CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the SpreadsheetML XML reader Reader\Xml does not validate the ss:Index row attribute against the maximum allowed row count AddressRange::MAXROW = 1,048,576. An attack...

CVE-2026-40863

CVE-2026-40863 affects PhpSpreadsheet’s SpreadsheetML XML reader. An attacker can craft an XML with an oversized ss:Index (e.g., 999999999) on a , inflating the internal cachedHighestRow to ~1 billion and causing CPU exhaustion during row iteration. This leads to denial of service when processing...

CVE-2026-40863

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the SpreadsheetML XML reader Reader\Xml does not validate the ss:Index row attribute against the maximum allowed row count AddressRange::MAXROW = 1,048,576. An attack...