CVE-2026-45034

🧨 PHPSpreadsheet Phar Deserialization Exploit BypassprohibitWrappers + Remote Code Execution RCE on phpoffice/phpspreadsheet This repository provides a proof-of-concept PoC exploit for a critical vulnerability in the popular PHP library PHPSpreadsheet. The attack abuses the phar:// wrapper to...

CVE-2024-45427-Exploit

Generador de Exploit CVE-2024-45427 Este script genera un archivo malicioso de Excel .xlsx para explotar CVE-2024-45427 en la librería PhpSpreadsheet v3.7.0. Inyecta una carga útil XSS en el nombre de la hoja manipulando el XML sin procesar, evadiendo las comprobaciones de validación estándar de ...

CVE-2024-47875-PhpSpreadsheet-XSS-PoC

CVE-2025-22131 • PhpSpreadsheet HTML Writer XSS PoC Over View this is a PoC on the CVE-2025-22131 , a Cross-Site Scripting XSS vulnerability in PhpSpreadsheet versions prior to 2.2.2, 2.1.2, and 1.29.4. The vulnerability resides in the generateNavigation function, which fails to sanitize sheet...

CVE-2025-22131-PoC

CVE-2025-22131-PoC PoC for CVE-2025-22131 PhpSpreadsheet is a library written in pure PHP and offers a set of classes that allow you to read and write various spreadsheet file formats such as Excel and LibreOffice Calc. phpspreadsheet version =2.2.0, =2.0.0, =3.0.0, sheetIndex === null $sheets =...

CLSA-2026-1786530064 TuxCare security update for phpoffice/phpspreadsheet (2 CVEs)

TuxCare rebuilt phpoffice/phpspreadsheet to address 2 CVEs. Fixed in 4.5.0-p3+tuxcare...

CVE-2026-59932

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the Gnumeric reader reads attacker-supplied .gnumeric files into memory an...

CVE-2026-59933

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the OLE reader follows sector chains from attacker-controlled XLS/OLE...

CVE-2026-59931

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE domain whitelist can be bypassed via an HTTP redirect SSRF...

CVE-2026-59932 PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the Gnumeric reader reads attacker-supplied .gnumeric files into memory an...

CVE-2026-59932 PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the Gnumeric reader reads attacker-supplied .gnumeric files into memory an...

CVE-2026-59933 PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the OLE reader follows sector chains from attacker-controlled XLS/OLE...

CVE-2026-59933

PhpSpreadsheet is affected by a memory-exhaustion denial-of-service in the OLERead::read() path when parsing attacker-controlled XLS/OLE metadata. The vulnerability stems from an unguarded sector-chain walk in the OLE reader that can loop indefinitely (self-loop in small-block depot/sector chains...

CVE-2026-59931

CVE-2026-59931 (PhpSpreadsheet SSRF via WEBSERVICE domain whitelist bypass) Concrete technical details are present in connected sources: PhpSpreadsheet’s Calculation/Web/Service.php validates the host against a domain whitelist but uses file_get_contents() with a PHP HTTP stream wrapper that foll...

EUVD-2026-49929

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE domain whitelist can be bypassed via an HTTP redirect SSRF...

CVE-2026-59931 PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE domain whitelist can be bypassed via an HTTP redirect SSRF...

CVE-2026-59931

creationtimestamp| type| source ---|---|--- 2026-07-23 16:35:09+00:00| published-proof-of-concept| https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg 2026-07-28 19:00:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrq3udnieo2f 2026-07-28...

CVE-2026-59932

creationtimestamp| type| source ---|---|--- 2026-07-23 16:35:07+00:00| published-proof-of-concept| https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-2mrg-gjxq-2gvr 2026-07-28 18:43:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrq2uso3v32e...

GHSA-XH5M-36R6-47M3 PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion

Summary PhpSpreadsheet's OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A tiny malformed .xls/OLE file can set the small-block depot sector chain to point back to itself. During normal XLS detection,...

Infinite loop

Overview phpoffice/phpspreadsheet is a Spreadsheet engine that Read, Create and Write Spreadsheet documents in PHP . Affected versions of this package are vulnerable to Infinite loop through the read function. An attacker can cause the application to exhaust system memory and crash by submitting ...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview phpoffice/phpspreadsheet is a Spreadsheet engine that Read, Create and Write Spreadsheet documents in PHP . Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification through the gzfileGetContents process. An attacker can exhaust...