Advisories / composer / phpoffice

composer

phpoffice/phpspreadsheet

Security advisories for phpoffice/phpspreadsheet, newest first. 35 known, 13 without a fix yet.

RSS feed Check your lock file →

Latest version

5.10.0

Advisories

35 · 13 unfixed

Last advisory

27 Oct 2026

Safe from

no fix for all yet

35 advisories · newest first

MODERATE6.4 27 Oct 2026

PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading

GHSA-2phh-27fw-q4gc · CVE-2026-108360

Affected

≤ 1.30.6 ≥ 2.0.0, ≤ 2.1.18 ≥ 2.2.0, ≤ 2.4.7

and 2 more

≥ 3.3.0, ≤ 3.10.7 ≥ 4.0.0, ≤ 5.9.0

Fixed in

no fix yet

Published

27 Oct 2026

HIGH 27 Oct 2026

PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)

GHSA-j2w7-387v-m2rq · CVE-2026-108359

Affected

≤ 1.30.6 ≥ 2.0.0, ≤ 2.1.18 ≥ 2.2.0, ≤ 2.4.7

and 2 more

≥ 3.3.0, ≤ 3.10.7 ≥ 4.0.0, ≤ 5.9.0

Fixed in

no fix yet

Published

27 Oct 2026

HIGH 27 Oct 2026

PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service

GHSA-3x94-m842-937c · CVE-2026-108358

Affected

≤ 1.30.6 ≥ 2.0.0, ≤ 2.1.18 ≥ 2.2.0, ≤ 2.4.7

and 2 more

≥ 3.3.0, ≤ 3.10.7 ≥ 4.0.0, ≤ 5.9.0

Fixed in

no fix yet

Published

27 Oct 2026

HIGH 27 Oct 2026

PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service

GHSA-rxj4-h86g-25gc · CVE-2026-108357

Affected

≥ 3.3.0, ≤ 3.10.7 ≥ 4.0.0, ≤ 5.9.0

Fixed in

no fix yet

Published

27 Oct 2026

HIGH7.5 23 Jul 2026

PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion

GHSA-xh5m-36r6-47m3 · CVE-2026-59933

Affected

≤ 1.30.5 ≥ 2.0.0, ≤ 2.1.17 ≥ 2.2.0, ≤ 2.4.6

and 2 more

≥ 3.3.0, ≤ 3.10.6 ≥ 4.0.0, ≤ 5.8.0

Fixed in

no fix yet

Published

23 Jul 2026

HIGH7.5 23 Jul 2026

PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion

GHSA-2mrg-gjxq-2gvr · CVE-2026-59932

Affected

≤ 1.30.5 ≥ 2.0.0, ≤ 2.1.17 ≥ 2.2.0, ≤ 2.4.6

and 2 more

≥ 3.3.0, ≤ 3.10.6 ≥ 4.0.0, ≤ 5.8.0

Fixed in

no fix yet

Published

23 Jul 2026

HIGH7.7 23 Jul 2026

PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist

GHSA-6hq5-7373-42rg · CVE-2026-59931

Affected

≤ 1.30.5 ≥ 2.0.0, ≤ 2.1.17 ≥ 2.2.0, ≤ 2.4.6

and 2 more

≥ 3.3.0, ≤ 3.10.6 ≥ 4.0.0, ≤ 5.8.0

Fixed in

no fix yet

Published

23 Jul 2026

CRITICAL 8 Jun 2026

PHPSpreadsheet has a patch bypass for CVE-2026-34084

GHSA-87m4-826x-3crx · CVE-2026-45034

Affected

≤ 1.30.4

Fixed in

no fix yet

Published

8 Jun 2026

HIGH7.5 29 Apr 2026

PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions

GHSA-7c6m-4442-2x6m · CVE-2026-40902

Affected

≤ 1.30.3 ≥ 2.0.0, ≤ 2.1.15 ≥ 2.2.0, ≤ 2.4.4

and 2 more

≥ 3.3.0, ≤ 3.10.4 ≥ 4.0.0, ≤ 5.6.0

Fixed in

no fix yet

Published

29 Apr 2026

HIGH7.5 29 Apr 2026

PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader

GHSA-84wq-86v6-x5j6 · CVE-2026-40863

Affected

≤ 1.30.5 ≥ 2.0.0, ≤ 2.1.15 ≥ 2.2.0, ≤ 2.4.4

and 2 more

≥ 3.3.0, ≤ 3.10.4 ≥ 4.0.0, ≤ 5.6.0

Fixed in

no fix yet

Published

29 Apr 2026

CRITICAL 29 Apr 2026

PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled

GHSA-q4q6-r8wh-5cgh · CVE-2026-34084

Affected

≤ 1.30.2 ≥ 2.0.0, ≤ 2.1.14 ≥ 2.2.0, ≤ 2.4.3

and 2 more

≥ 3.3.0, ≤ 3.10.3 ≥ 4.0.0, ≤ 5.5.0

Fixed in

no fix yet

Published

29 Apr 2026

MODERATE5.4 28 Apr 2026

PhpSpreadsheet has XSS via number format code with @ text placeholder bypasses htmlspecialchars in HTML writer

GHSA-hrmw-qprp-wgmc · CVE-2026-40296

Affected

≤ 1.30.3 ≥ 2.0.0, ≤ 2.1.15 ≥ 2.2.0, ≤ 2.4.4

and 2 more

≥ 3.3.0, ≤ 3.10.4 ≥ 4.0.0, ≤ 5.6.0

Fixed in

no fix yet

Published

28 Apr 2026

MODERATE 28 Apr 2026

PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer

GHSA-6wpp-88cp-7q68 · CVE-2026-35453

Affected

≤ 1.30.3 ≥ 2.0.0, ≤ 2.1.15 ≥ 2.2.0, ≤ 2.4.4

and 2 more

≥ 3.3.0, ≤ 3.10.4 ≥ 4.0.0, ≤ 5.6.0

Fixed in

no fix yet

Published

28 Apr 2026

HIGH 3 Aug 2025

PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser

GHSA-rx7m-68vc-ppxh · CVE-2025-54370

Affected

< 1.30.0 ≥ 2.0.0, < 2.1.12 ≥ 2.2.0, < 2.4.0

and 2 more

≥ 3.0.0, < 3.10.0 ≥ 4.0.0, < 5.0.0

Fixed in

1.30.0 2.1.12 2.4.0

and 2 more

3.10.0 5.0.0

Published

3 Aug 2025

MODERATE5.4 3 Feb 2025

PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters

GHSA-r57h-547h-w24f · CVE-2025-23210

Affected

< 1.29.9 ≥ 2.0.0, < 2.1.8 ≥ 2.2.0, < 2.3.7

and 1 more

≥ 3.0.0, < 3.9.0

Fixed in

1.29.9 2.1.8 2.3.7

and 1 more

3.9.0

Published

3 Feb 2025

MODERATE6.1 21 Jan 2025

Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet

GHSA-79xx-vf93-p7cx · CVE-2025-22131

Affected

< 1.29.8 ≥ 2.0.0, < 2.1.7 ≥ 2.2.0, < 2.3.6

and 1 more

≥ 3.0.0, < 3.8.0

Fixed in

1.29.8 2.1.7 2.3.6

and 1 more

3.8.0

Published

21 Jan 2025

MODERATE5.4 3 Jan 2025

PhpSpreadsheet allows bypass XSS sanitizer using the javascript protocol and special characters

GHSA-q9jv-mm3r-j47r · CVE-2024-56412

Affected

≤ 1.29.6 ≥ 2.0.0, ≤ 2.1.5 ≥ 2.2.0, ≤ 2.3.4

and 1 more

≥ 3.0.0, < 3.7.0

Fixed in

3.7.0

Published

3 Jan 2025

MODERATE5.4 3 Jan 2025

PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header

GHSA-hwcp-2h35-p66w · CVE-2024-56411

Affected

≤ 1.29.6 ≥ 2.0.0, ≤ 2.1.5 ≥ 2.2.0, ≤ 2.3.4

and 1 more

≥ 3.0.0, < 3.7.0

Fixed in

3.7.0

Published

3 Jan 2025

MODERATE5.4 3 Jan 2025

PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability in custom properties

GHSA-wv23-996v-q229 · CVE-2024-56410

Affected

≤ 1.29.6 ≥ 2.0.0, ≤ 2.1.5 ≥ 2.2.0, ≤ 2.3.4

and 1 more

≥ 3.0.0, < 3.7.0

Fixed in

3.7.0

Published

3 Jan 2025

HIGH7.1 3 Jan 2025

PhpSpreadsheet allows unauthorized Reflected XSS in Currency.php file

GHSA-j2xg-cjcx-4677 · CVE-2024-56409

Affected

≤ 1.29.6 ≥ 2.0.0, ≤ 2.1.5 ≥ 2.2.0, ≤ 2.3.4

and 1 more

≥ 3.0.0, < 3.7.0

Fixed in

3.7.0

Published

3 Jan 2025

HIGH7.1 3 Jan 2025

PhpSpreadsheet allows unauthorized Reflected XSS in the Accounting.php file

GHSA-c6fv-7vh8-2rhr · CVE-2024-56366

Affected

≤ 1.29.6 ≥ 2.0.0, ≤ 2.1.5 ≥ 2.2.0, ≤ 2.3.4

and 1 more

≥ 3.0.0, < 3.7.0

Fixed in

3.7.0

Published

3 Jan 2025

HIGH7.1 3 Jan 2025

PhpSpreadsheet allows unauthorized Reflected XSS in the constructor of the Downloader class

GHSA-jmpx-686v-c3wx · CVE-2024-56365

Affected

≤ 1.29.6 ≥ 2.0.0, ≤ 2.1.5 ≥ 2.2.0, ≤ 2.3.4

and 1 more

≥ 3.0.0, < 3.7.0

Fixed in

3.7.0

Published

3 Jan 2025

HIGH7.1 3 Jan 2025

PhpSpreadsheet allows unauthorized Reflected XSS in `Convert-Online.php` file

GHSA-x88g-h956-m5xg · CVE-2024-56408

Affected

≤ 1.29.6 ≥ 2.0.0, ≤ 2.1.5 ≥ 2.2.0, ≤ 2.3.4

and 1 more

≥ 3.0.0, < 3.7.0

Fixed in

3.7.0

Published

3 Jan 2025

HIGH7.5 18 Nov 2024

XXE in PHPSpreadsheet's XLSX reader

GHSA-7cc9-j4mv-vcjp · CVE-2024-48917

Affected

< 1.29.4 ≥ 2.0.0, < 2.1.3 ≥ 2.2.0, < 2.3.2

and 1 more

≥ 3.3.0, < 3.4.0

Fixed in

1.29.4 2.1.3 2.3.2

and 1 more

3.4.0

Published

18 Nov 2024

HIGH7.5 18 Nov 2024

XmlScanner bypass leads to XXE

GHSA-jw4x-v69f-hh5w · CVE-2024-47873

Affected

< 1.29.4 ≥ 2.0.0, < 2.1.3 ≥ 2.2.0, < 2.3.2

and 1 more

≥ 3.3.0, < 3.4.0

Fixed in

1.29.4 2.1.3 2.3.2

and 1 more

3.4.0

Published

18 Nov 2024

HIGH7.5 7 Oct 2024

XXE in PHPSpreadsheet's XLSX reader

GHSA-6hwr-6v2f-3m88 · CVE-2024-45293

Affected

< 1.29.1 ≥ 2.0.0, < 2.1.1 ≥ 2.2.0, < 2.3.0

Fixed in

1.29.1 2.1.1 2.3.0

Published

7 Oct 2024

MODERATE5.4 7 Oct 2024

PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks

GHSA-r8w8-74ww-j4wh · CVE-2024-45292

Affected

< 1.29.2 ≥ 2.0.0, < 2.1.1 ≥ 2.2.0, < 2.3.0

Fixed in

1.29.2 2.1.1 2.3.0

Published

7 Oct 2024

MODERATE6.3 7 Oct 2024

PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled

GHSA-w9xv-qf98-ccq4 · CVE-2024-45291

Affected

< 1.29.2 ≥ 2.0.0, < 2.1.1 ≥ 2.2.0, < 2.3.0

Fixed in

1.29.2 2.1.1 2.3.0

Published

7 Oct 2024

HIGH7.7 7 Oct 2024

PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery when opening XLSX file

GHSA-5gpr-w2p5-6m37 · CVE-2024-45290

Affected

< 1.29.2 ≥ 2.0.0, < 2.1.1 ≥ 2.2.0, < 2.3.0

Fixed in

1.29.2 2.1.1 2.3.0

Published

7 Oct 2024

MODERATE6.1 7 Oct 2024

PhpSpreadsheet has an Unauthenticated Cross-Site-Scripting (XSS) in sample file

GHSA-v66g-p9x6-v98p · CVE-2024-45060

Affected

< 1.29.2 ≥ 2.0.0, < 2.1.1 ≥ 2.2.0, < 2.3.0

Fixed in

1.29.2 2.1.1 2.3.0

Published

7 Oct 2024

HIGH8.8 29 Aug 2024

XXE in PHPSpreadsheet encoding is returned

GHSA-ghg6-32f9-2jp7 · CVE-2024-45048

Affected

< 1.29.1 ≥ 2.0.0, < 2.1.1 ≥ 2.2.0, < 2.2.1

Fixed in

1.29.1 2.1.1 2.2.1

Published

29 Aug 2024

MODERATE5.4 29 Aug 2024

PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information

GHSA-wgmf-q9vr-vww6 · CVE-2024-45046

Affected

< 1.29.1 ≥ 2.0.0, < 2.1.0

Fixed in

1.29.1 2.1.0

Published

29 Aug 2024

MODERATE6.4 31 Dec 2020

XSS Vulnerability in HTML Writer

PKSA-xgcn-ywd7-3wqn · CVE-2020-7776

Affected

< 1.16.0

Fixed in

1.16.0

Published

31 Dec 2020

HIGH8.8 1 Jul 2019

XXE Vulnerability

PKSA-zdkr-vbc6-f2vy · CVE-2019-12331

Affected

< 1.8.0

Fixed in

1.8.0

Published

1 Jul 2019

HIGH8.8 20 Nov 2018

XXE Vulnerability

PKSA-v15t-c7gz-7kpt · CVE-2018-19277

Affected

< 1.5.1

Fixed in

1.5.1

Published

20 Nov 2018

/advisories/composer/phpoffice/phpspreadsheet/feed.rss

From Packagist and the GitHub advisory database · synced hourly

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →