What’s Vulnerable › Products

PHPOffice PhpSpreadsheet vulnerabilities

35 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 25 published in the last 12 months.

Check whether your PHPOffice PhpSpreadsheet version is affected

Latest PHPOffice PhpSpreadsheet vulnerabilities

• CVE-2026-108360 — PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading (CVSS 6.4)
• CVE-2026-108359 — PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS) (CVSS 8.7)
• CVE-2026-108358 — PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service (CVSS 8.8)
• CVE-2026-108357 — PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service (CVSS 8.8)
• CVE-2026-59932 — PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion (CVSS 7.5)
• CVE-2026-59933 — PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion (CVSS 7.5)
• CVE-2026-59931 — PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist (CVSS 7.7)
• CVE-2026-45034 — PhpSpreadsheet: File::prohibitWrappers bypass (CVSS 9.2)
• CVE-2026-40902 — PhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions (CVSS 7.5)
• CVE-2026-40863 — PhpSpreadsheet: CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader (CVSS 7.5)
• CVE-2026-40296 — PhpSpreadsheet vulnerable to XSS in HTML writer via custom number format codes (CVSS 5.4)
• CVE-2026-35453 — PhpSpreadsheet XSS via number format text substitution in HTML Writer (CVSS 5.4)
• CVE-2026-34084 — PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load (CVSS 9.8)
• CVE-2025-54370 — PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser (CVSS 8.7)
• CVE-2025-23210 — Bypass XSS sanitizer using the javascript protocol and special characters in phpoffice/phpspreadsheet (CVSS 4.8)
• CVE-2025-22131 — Cross-Site Scripting (XSS) vulnerability in generateNavigation() function (CVSS 6.1)
• CVE-2024-56412 — PhpSpreadsheet vulnerable to bypass of the XSS sanitizer using the javascript protocol and special characters (CVSS 5.4)
• CVE-2024-56411 — PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header (CVSS 5.4)
• CVE-2024-56410 — PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability in custom properties (CVSS 5.4)
• CVE-2024-56409 — PhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php file (CVSS 5.4)
• CVE-2024-56366 — PhpSpreadsheet vulnerable to unauthorized reflected XSS in the Accounting.php file (CVSS 5.4)
• CVE-2024-56365 — PhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader class (CVSS 5.4)
• CVE-2024-56408 — PhpSpreadsheet allows unauthorized reflected XSS in `Convert-Online.php` file (CVSS 5.4)
• CVE-2024-48917 — XXE in PHPSpreadsheet's XLSX reader (CVSS 7.5)
• CVE-2024-47873 — PhpSpreadsheet XmlScanner bypass leads to XXE (CVSS 7.5)