531 matches found
CVE-2024-45427-Exploit
CVE-2024-45427 Exploit Generator This script generates a malicious Excel .xlsx file to exploit CVE-2024-45427 in PhpSpreadsheet library v3.7.0. It injects an XSS payload into the sheet name by manipulating the raw XML, bypassing standard library validation checks. Usage 1. Edit exploit.py and set...
CVE-2024-47875-PhpSpreadsheet-XSS-PoC
CVE-2025-22131 • PhpSpreadsheet HTML Writer XSS PoC Over View this is a PoC on the CVE-2025-22131 , a Cross-Site Scripting XSS vulnerability in PhpSpreadsheet versions prior to 2.2.2, 2.1.2, and 1.29.4. The vulnerability resides in the generateNavigation function, which fails to sanitize sheet...
CVE-2026-45034
🧨 PHPSpreadsheet Phar Deserialization Exploit BypassprohibitWrappers + Remote Code Execution RCE on phpoffice/phpspreadsheet This repository provides a proof-of-concept PoC exploit for a critical vulnerability in the popular PHP library PHPSpreadsheet. The attack abuses the phar:// wrapper to...
CVE-2025-22131-PoC
CVE-2025-22131-PoC PoC for CVE-2025-22131 PhpSpreadsheet is a library written in pure PHP and offers a set of classes that allow you to read and write various spreadsheet file formats such as Excel and LibreOffice Calc. phpspreadsheet version =2.2.0, =2.0.0, =3.0.0, sheetIndex === null $sheets =...
PhpSpreadsheet SSRF
The vulnerability in the Worksheet\Drawing::setPath function within the src/PhpSpreadsheet/Worksheet/Drawing.php file of the PhpSpreadsheet library is related to authorization process flaws. Exploitation of this vulnerability could enable a remote attacker to carry out an SSRF attack...
CLSA-2026-1793372756 TuxCare security update for phpoffice/phpspreadsheet (3 CVEs)
TuxCare rebuilt phpoffice/phpspreadsheet to address 3 CVEs. Fixed in 4.5.0-p5+tuxcare...
CLSA-2026-1793283095 TuxCare security update for phpoffice/phpspreadsheet (1 CVE)
TuxCare rebuilt phpoffice/phpspreadsheet to address 1 CVE. Fixed in 4.5.0-p4+tuxcare...
PT-2026-140081
TuxCare rebuilt phpoffice/phpspreadsheet to address 1 CVE. Fixed in 4.5.0-p4+tuxcare...
GHSA-2PHH-27FW-Q4GC PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading
Summary PhpSpreadsheet's Worksheet\Drawing::setPath validates an external-image URL against an operator-supplied isWhitelisted callback once, on the initial URL only, then fetches it with filegetcontents using a stream context that does not set followlocation = 0. A whitelisted host that returns ...
PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading
Summary PhpSpreadsheet's Worksheet\Drawing::setPath validates an external-image URL against an operator-supplied isWhitelisted callback once, on the initial URL only, then fetches it with filegetcontents using a stream context that does not set followlocation = 0. A whitelisted host that returns ...
EUVD-2026-108264
PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading...
PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)
Summary When PhpSpreadsheet loads an OpenDocument Spreadsheet .ods, Ods::processTableRow reads the table:number-rows-repeated attribute of a with an unchecked int cast, then materialises one cell per repeated row. This value is completely unbounded, so a single 1.4 KB file can instruct the reader...
GHSA-J2W7-387V-M2RQ PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)
Summary When PhpSpreadsheet loads an OpenDocument Spreadsheet .ods, Ods::processTableRow reads the table:number-rows-repeated attribute of a with an unchecked int cast, then materialises one cell per repeated row. This value is completely unbounded, so a single 1.4 KB file can instruct the reader...
EUVD-2026-108267
PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion DoS...
EUVD-2026-108265
PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service...
GHSA-3X94-M842-937C PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service
Summary PhpSpreadsheet's XmlScanner::scan uses a regex pattern that only accounts for NULL byte 0x00 interleaving when detecting !DOCTYPE. ISO-2022 escape sequences 0x1B bytes inserted between the characters of the pattern break the regex match entirely, allowing DOCTYPE declarations with entity...
PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service
Summary PhpSpreadsheet's XmlScanner::scan uses a regex pattern that only accounts for NULL byte 0x00 interleaving when detecting !DOCTYPE. ISO-2022 escape sequences 0x1B bytes inserted between the characters of the pattern break the regex match entirely, allowing DOCTYPE declarations with entity...
GHSA-RXJ4-H86G-25GC PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service
Summary The SpreadsheetML XML reader Reader\Xml scans file content twice through XmlScanner::scan, and each scan runs an unentity callback that calls htmlentitydecode after the pattern check. By double-encoding the toUtf8$xml; if pregmatch$pattern, $xml // CHECK 2 UTF-8 throw new Exception'Detect...
PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service
Summary The SpreadsheetML XML reader Reader\Xml scans file content twice through XmlScanner::scan, and each scan runs an unentity callback that calls htmlentitydecode after the pattern check. By double-encoding the toUtf8$xml; if pregmatch$pattern, $xml // CHECK 2 UTF-8 throw new Exception'Detect...