CVE-2026-59932

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the Gnumeric reader reads attacker-supplied .gnumeric files into memory an...

CVE-2026-59933

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the OLE reader follows sector chains from attacker-controlled XLS/OLE...

CVE-2026-59931

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE domain whitelist can be bypassed via an HTTP redirect SSRF...

CVE-2026-59932 PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the Gnumeric reader reads attacker-supplied .gnumeric files into memory an...

CVE-2026-59932 PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the Gnumeric reader reads attacker-supplied .gnumeric files into memory an...

CVE-2026-59933 PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the OLE reader follows sector chains from attacker-controlled XLS/OLE...

CVE-2026-59933

PhpSpreadsheet is affected by a memory-exhaustion denial-of-service in the OLERead::read() path when parsing attacker-controlled XLS/OLE metadata. The vulnerability stems from an unguarded sector-chain walk in the OLE reader that can loop indefinitely (self-loop in small-block depot/sector chains...

CVE-2026-59931

CVE-2026-59931 (PhpSpreadsheet SSRF via WEBSERVICE domain whitelist bypass) Concrete technical details are present in connected sources: PhpSpreadsheet’s Calculation/Web/Service.php validates the host against a domain whitelist but uses file_get_contents() with a PHP HTTP stream wrapper that foll...

CVE-2026-59931 PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE domain whitelist can be bypassed via an HTTP redirect SSRF...

EUVD-2026-49929

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE domain whitelist can be bypassed via an HTTP redirect SSRF...

CVE-2026-59931

creationtimestamp| type| source ---|---|--- 2026-07-23 16:35:09+00:00| published-proof-of-concept| https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg 2026-07-28 19:00:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrq3udnieo2f 2026-07-28...

CVE-2026-59932

creationtimestamp| type| source ---|---|--- 2026-07-23 16:35:07+00:00| published-proof-of-concept| https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-2mrg-gjxq-2gvr 2026-07-28 18:43:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrq2uso3v32e...

GHSA-XH5M-36R6-47M3 PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion

Summary PhpSpreadsheet's OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A tiny malformed .xls/OLE file can set the small-block depot sector chain to point back to itself. During normal XLS detection,...

Infinite loop

Overview phpoffice/phpspreadsheet is a Spreadsheet engine that Read, Create and Write Spreadsheet documents in PHP . Affected versions of this package are vulnerable to Infinite loop through the read function. An attacker can cause the application to exhaust system memory and crash by submitting ...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview phpoffice/phpspreadsheet is a Spreadsheet engine that Read, Create and Write Spreadsheet documents in PHP . Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification through the gzfileGetContents process. An attacker can exhaust...

GHSA-2MRG-GJXQ-2GVR PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion

Summary PhpSpreadsheet's Gnumeric reader reads attacker-supplied .gnumeric files into memory and, when the file starts with gzip magic bytes, calls gzdecode on the full compressed contents without enforcing a decompressed-size limit. A very small compressed .gnumeric file can expand to data large...

Server-side Request Forgery (SSRF)

Overview phpoffice/phpspreadsheet is a Spreadsheet engine that Read, Create and Write Spreadsheet documents in PHP . Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the webService process. An attacker can access internal services and exfiltrate sensitive da...

PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist

Summary The domain whitelist introduced in PhpSpreadsheet 5.4.0 for the WEBSERVICE formula function can be bypassed via HTTP redirect. The whitelist validates only the initial URL's hostname, but filegetcontents follows 302/301 redirects by default without re-validating the redirect target agains...

The vulnerability of the OLERead::read() function in the src/PhpSpreadsheet/Shared/OLERead.php script of the PhpSpreadsheet library allows a hacker to trigger a service failure.

The vulnerability of the OLERead::read function in the src/PhpSpreadsheet/Shared/OLERead.php script of the PhpSpreadsheet library is related to the execution of a loop with an unavailable exit condition. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

The vulnerability of the gzfileGetContents() method in the src/PhpSpreadsheet/Reader/Gnumeric.php script of the PhpSpreadsheet library allows a attacker to cause a service failure.

The vulnerability of the gzfileGetContents method in the src/PhpSpreadsheet/Reader/Gnumeric.php script of the PhpSpreadsheet library is related to incorrect processing of highly compressed input data. Exploiting this vulnerability could allow an attacker to cause a service failure...