Phpoffice Phpspreadsheet vulnerabilities

• phpoffice phpspreadsheet PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service CVE-2026-108357 Fix available 8.8 HighOctober 22, 2026
• phpoffice phpspreadsheet PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS) CVE-2026-108359 Fix available 8.7 HighOctober 22, 2026
• phpoffice phpspreadsheet PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service CVE-2026-108358 Fix available 8.8 HighOctober 22, 2026
• phpoffice phpspreadsheet PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading CVE-2026-108360 Fix available 6.4 MediumOctober 22, 2026
• phpoffice phpspreadsheet PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion CVE-2026-59933 Fix available 7.5 HighJuly 23, 2026
• phpoffice phpspreadsheet PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion CVE-2026-59932 Fix available 7.5 HighJuly 23, 2026
• phpoffice phpspreadsheet PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist CVE-2026-59931 Fix available 7.7 HighJuly 23, 2026
• phpoffice phpspreadsheet PhpSpreadsheet: File::prohibitWrappers bypass CVE-2026-45034 Public exploitFix available 9.2 CriticalJune 8, 2026
• phpoffice phpspreadsheet PhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions CVE-2026-40902 Fix available 7.5 HighApril 29, 2026
• phpoffice phpspreadsheet PhpSpreadsheet: CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader CVE-2026-40863 Fix available 7.5 HighApril 29, 2026
• phpoffice phpspreadsheet PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load CVE-2026-34084 Fix available 9.2 CriticalApril 29, 2026
• phpoffice phpspreadsheet PhpSpreadsheet vulnerable to XSS in HTML writer via custom number format codes CVE-2026-40296 Fix available 5.4 MediumApril 28, 2026
• phpoffice phpspreadsheet PhpSpreadsheet XSS via number format text substitution in HTML Writer CVE-2026-35453 Fix available 4.8 MediumApril 28, 2026
• phpoffice phpspreadsheet PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser CVE-2025-54370 Fix available 8.7 HighAugust 25, 2025
• phpoffice phpspreadsheet Bypass XSS sanitizer using the javascript protocol and special characters in phpoffice/phpspreadsheet CVE-2025-23210 Fix available 4.8 MediumFebruary 3, 2025
• phpoffice phpspreadsheet Cross-Site Scripting (XSS) vulnerability in generateNavigation() function CVE-2025-22131 Public exploitFix available 5.1 MediumJanuary 20, 2025
• phpoffice phpspreadsheet PhpSpreadsheet vulnerable to bypass of the XSS sanitizer using the javascript protocol and special characters CVE-2024-56412 Fix available 4.8 MediumJanuary 3, 2025
• phpoffice phpspreadsheet PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header CVE-2024-56411 Fix available 4.8 MediumJanuary 3, 2025
• phpoffice phpspreadsheet PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability in custom properties CVE-2024-56410 Fix available 4.8 MediumJanuary 3, 2025
• phpoffice phpspreadsheet PhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php file CVE-2024-56409 Fix available 8.3 HighJanuary 3, 2025
• phpoffice phpspreadsheet PhpSpreadsheet vulnerable to unauthorized reflected XSS in the Accounting.php file CVE-2024-56366 Fix available 8.3 HighJanuary 3, 2025
• phpoffice phpspreadsheet PhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader class CVE-2024-56365 Fix available 8.3 HighJanuary 3, 2025
• phpoffice phpspreadsheet PhpSpreadsheet allows unauthorized reflected XSS in `Convert-Online.php` file CVE-2024-56408 Fix available 8.3 HighJanuary 3, 2025
• phpoffice phpspreadsheet XXE in PHPSpreadsheet's XLSX reader CVE-2024-48917 Fix available 7.5 HighNovember 18, 2024
• phpoffice phpspreadsheet PhpSpreadsheet XmlScanner bypass leads to XXE CVE-2024-47873 Fix available 7.5 HighNovember 18, 2024
• phpoffice phpspreadsheet XML External Entity Reference (XXE) in PHPSpreadsheet's XLSX reader CVE-2024-45293 Fix available 7.5 HighOctober 7, 2024
• phpoffice phpspreadsheet PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks CVE-2024-45292 Fix available 5.4 MediumOctober 7, 2024
• phpoffice phpspreadsheet Path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled in PHPSpreadsheet CVE-2024-45291 Fix available 6.3 MediumOctober 7, 2024
• phpoffice phpspreadsheet Path traversal and Server-Side Request Forgery when opening XLSX files in PHPSpreadsheet CVE-2024-45290 Fix available 7.7 HighOctober 7, 2024
• phpoffice phpspreadsheet Unauthenticated Cross-Site-Scripting (XSS) in sample file in PHPSpreadsheet CVE-2024-45060 Fix available 7.1 HighOctober 7, 2024
• phpoffice phpspreadsheet PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information CVE-2024-45046 Fix available 5.4 MediumAugust 28, 2024
• phpoffice phpspreadsheet XML External Entity Reference (XXE) in PHPSpreadsheet CVE-2024-45048 Fix available 8.8 HighAugust 28, 2024
• phpoffice phpspreadsheet Cross-site Scripting (XSS) CVE-2020-7776 Fix available 7.1 HighDecember 9, 2020
• phpoffice phpspreadsheet XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue CVE-2019-12331 Fix available 8.8 HighNovember 7, 2019
• phpoffice phpspreadsheet XXE in PHPSpreadsheet due to encoding issue CVE-2018-19277 Public exploitFix available 8.8 HighNovember 14, 2018