XML External Entity (XXE) Injection

Overview phpoffice/phpspreadsheet is a Spreadsheet engine that Read, Create and Write Spreadsheet documents in PHP . Affected versions of this package are vulnerable to XML External Entity XXE Injection via the unentity method in src/PhpSpreadsheet/Reader/Xml.php, where HTML entities in XML...

Allocation of Resources Without Limits or Throttling

Overview phpoffice/phpspreadsheet is a Spreadsheet engine that Read, Create and Write Spreadsheet documents in PHP . Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the ODS file reader in src/PhpSpreadsheet/Reader/Ods.php, where the...

XML External Entity (XXE) Injection

Overview phpoffice/phpspreadsheet is a Spreadsheet engine that Read, Create and Write Spreadsheet documents in PHP . Affected versions of this package are vulnerable to XML External Entity XXE Injection via the ODS file reader in src/PhpSpreadsheet/Reader/Ods.php, where the...

Incorrect Authorization

Overview phpoffice/phpspreadsheet is a Spreadsheet engine that Read, Create and Write Spreadsheet documents in PHP . Affected versions of this package are vulnerable to Incorrect Authorization via the ODS file reader in src/PhpSpreadsheet/Reader/Ods.php and the XML scanner in...

PHPOffice PhpSpreadsheet resource management error vulnerability

Versions prior to PHPOffice PhpSpreadsheet 1.30.7, versions 2.0.0 through 2.1.19, versions 2.2.0 through 2.4.8, versions 3.3.0 through 3.10.8, and versions 4.0.0 through 5.10.0 contain a resource management error vulnerability. This vulnerability stems from Ods::processTableRow in...

PHPOffice PhpSpreadsheet input validation error vulnerability

PHPOffice PhpSpreadsheet versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and earlier versions prior to 5.10.0 contain a security vulnerability. This vulnerability arises because the DOCTYPE detection mechanism in XmlScanner::scan fails to account for ISO-2022 escaped sequences within XLSX XML sections. A...

PHPOffice PhpSpreadsheet input validation error vulnerability

A security vulnerability exists in PHPOffice PhpSpreadsheet versions prior to 3.10.8 and 4.0.0 up to 5.10.0. This vulnerability stems from improper entity decoding of SpreadsheetML XML by Reader\Xml. The double-encoded “” becomes a literal “” after two callbacks, allowing SimpleXML to receive...

CVE-2026-114404

PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attribut...

CVE-2026-114403

PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize,...

EUVD-2026-107251

PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attribut...

CVE-2026-114404 PHPPresentation 1.2.0 XSS via Writer\HTML Text Runs, Hyperlinks and Descriptions

PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attribut...

CVE-2026-114404

PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attribut...

CVE-2026-114403 PHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\Serialized::load

PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize,...

CVE-2026-114403 PHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\Serialized::load

PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize,...

CVE-2026-114403

PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize,...

EUVD-2026-107250

PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize,...

CVE-2026-114403

The PHPOffice PHPPresentation library (versions through 1.2.0 ) is vulnerable to an insecure deserialization flaw in the Reader bSerialized::load function. An attacker can exploit this by uploading a crafted ZIP file containing a PhpPresentation.xml file. When IOFactory::load processes this file,...

PT-2026-120591

PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attribut...

PHPOffice PHPPresentation deserialization injection vulnerability

PHPOffice PHPPresentation versions 1.2.0 and earlier contain a deserialization injection vulnerability. This vulnerability stems from unsafe deserialization practices; attackers can exploit it by uploading a ZIP file containing PhpPresentation.xml and passing it to the unserialize function via...

PT-2026-120590

PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize,...