PackagistPackage

phpoffice/phpspreadsheet

35 known vulnerabilities (2 critical, 20 high, 11 medium), with the versions each affects and the releases that fix them.

Latest release: Not known: cve.now hasn't read this package's releases
Newest unaffected release: Not known without release data
Advisories: 35 · 2 critical, 20 high, 11 medium

Registry: Packagist

Advisories 35

CVE-2026-108357High 8.8
PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service
Affected: from 4.0.0, fixed in 5.10.0; from 3.3.0, fixed in 3.10.8.
CVE-2026-108359High 8.7
PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)
Affected: from 4.0.0, fixed in 5.10.0; from 3.3.0, fixed in 3.10.8; from 2.2.0, fixed in 2.4.8; from 2.0.0, fixed in 2.1.19; fixed in 1.30.7.
CVE-2026-108358High 8.8
PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service
Affected: from 4.0.0, fixed in 5.10.0; from 3.3.0, fixed in 3.10.8; from 2.2.0, fixed in 2.4.8; from 2.0.0, fixed in 2.1.19; fixed in 1.30.7.
CVE-2026-108360Medium 6.4
PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading
Affected: from 4.0.0, fixed in 5.10.0; from 3.3.0, fixed in 3.10.8; from 2.2.0, fixed in 2.4.8; from 2.0.0, fixed in 2.1.19; fixed in 1.30.7.
CVE-2026-59932High 7.5
PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
Affected: from 4.0.0, fixed in 5.8.1; from 3.3.0, fixed in 3.10.7; from 2.2.0, fixed in 2.4.7; from 2.0.0, fixed in 2.1.18; fixed in 1.30.6.
CVE-2026-59933High 7.5
PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
Affected: from 4.0.0, fixed in 5.8.1; from 3.3.0, fixed in 3.10.7; from 2.2.0, fixed in 2.4.7; from 2.0.0, fixed in 2.1.18; fixed in 1.30.6.
CVE-2026-59931High 7.7
PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
Affected: from 4.0.0, fixed in 5.8.1; from 3.3.0, fixed in 3.10.7; from 2.2.0, fixed in 2.4.7; from 2.0.0, fixed in 2.1.18; fixed in 1.30.6.
CVE-2026-45034Critical 9.2
PhpSpreadsheet: File::prohibitWrappers bypass
Affected: fixed in 1.30.5.
CVE-2026-40863High 7.5
PhpSpreadsheet: CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader
Affected: from 4.0.0, fixed in 5.7.0; from 3.3.0, fixed in 3.10.5; from 2.2.0, fixed in 2.4.5; from 2.0.0, fixed in 2.1.16; fixed in 1.30.6.
CVE-2026-40902High 7.5
PhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions
Affected: from 4.0.0, fixed in 5.7.0; from 3.3.0, fixed in 3.10.5; from 2.2.0, fixed in 2.4.5; from 2.0.0, fixed in 2.1.16; fixed in 1.30.4.
CVE-2026-40296Medium 5.4
PhpSpreadsheet vulnerable to XSS in HTML writer via custom number format codes
Affected: from 4.0.0, fixed in 5.7.0; from 3.3.0, fixed in 3.10.5; from 2.2.0, fixed in 2.4.5; from 2.0.0, fixed in 2.1.16; fixed in 1.30.4.
CVE-2026-35453Medium 4.8
PhpSpreadsheet XSS via number format text substitution in HTML Writer
Affected: from 4.0.0, fixed in 5.7.0; from 3.3.0, fixed in 3.10.5; from 2.2.0, fixed in 2.4.5; from 2.0.0, fixed in 2.1.16; fixed in 1.30.4.
CVE-2026-34084Critical 9.2
PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load
Affected: from 4.0.0, fixed in 5.6.0; from 3.3.0, fixed in 3.10.4; from 2.2.0, fixed in 2.4.4; from 2.0.0, fixed in 2.1.15; fixed in 1.30.3.
CVE-2025-54370High 8.7
PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser
Affected: fixed in 1.30.0; from 2.0.0, fixed in 2.1.12; from 2.2.0, fixed in 2.4.0; from 3.0.0, fixed in 3.10.0; from 4.0.0, fixed in 5.0.0.
CVE-2025-23210Medium 4.8
Bypass XSS sanitizer using the javascript protocol and special characters in phpoffice/phpspreadsheet
Affected: from 3.0.0, fixed in 3.9.0; fixed in 1.29.9; from 2.2.0, fixed in 2.3.7; from 2.0.0, fixed in 2.1.8.

Show all 35 advisoriesShow fewer advisories

CVE-2025-22131Medium 5.1
Cross-Site Scripting (XSS) vulnerability in generateNavigation() function
Affected: from 3.0.0, fixed in 3.8.0; fixed in 1.29.8; from 2.0.0, fixed in 2.1.7; from 2.2.0, fixed in 2.3.6.
CVE-2024-56412Medium 4.8
PhpSpreadsheet vulnerable to bypass of the XSS sanitizer using the javascript protocol and special characters
Affected: from 3.0.0, fixed in 3.7.0; fixed in 1.29.7; from 2.0.0, fixed in 2.1.6; from 2.2.0, fixed in 2.3.5.
CVE-2024-56411Medium 4.8
PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header
Affected: from 3.0.0, fixed in 3.7.0; fixed in 1.29.7; from 2.0.0, fixed in 2.1.6; from 2.2.0, fixed in 2.3.5.
CVE-2024-56410Medium 4.8
PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability in custom properties
Affected: from 3.0.0, fixed in 3.7.0; fixed in 1.29.7; from 2.0.0, fixed in 2.1.6; from 2.2.0, fixed in 2.3.5.
CVE-2024-56409High 8.3
PhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php file
Affected: from 3.0.0, fixed in 3.7.0; fixed in 1.29.7; from 2.0.0, fixed in 2.1.6; from 2.2.0, fixed in 2.3.5.
CVE-2024-56366High 8.3
PhpSpreadsheet vulnerable to unauthorized reflected XSS in the Accounting.php file
Affected: from 3.0.0, fixed in 3.7.0; fixed in 1.29.7; from 2.0.0, fixed in 2.1.6; from 2.2.0, fixed in 2.3.5.
CVE-2024-56365High 8.3
PhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader class
Affected: from 3.0.0, fixed in 3.7.0; fixed in 1.29.7; from 2.0.0, fixed in 2.1.6; from 2.2.0, fixed in 2.3.5.
CVE-2024-56408High 8.3
PhpSpreadsheet allows unauthorized reflected XSS in `Convert-Online.php` file
Affected: from 3.0.0, fixed in 3.7.0; fixed in 1.29.7; from 2.0.0, fixed in 2.1.6; from 2.2.0, fixed in 2.3.5.
CVE-2024-48917High 7.5
XXE in PHPSpreadsheet's XLSX reader
Affected: fixed in 1.29.4; from 2.0.0, fixed in 2.1.3; from 2.2.0, fixed in 2.3.2; from 3.3.0, fixed in 3.4.0.
CVE-2024-47873High 7.5
PhpSpreadsheet XmlScanner bypass leads to XXE
Affected: fixed in 1.29.4; from 2.0.0, fixed in 2.1.3; from 2.2.0, fixed in 2.3.2; from 3.3.0, fixed in 3.4.0.
CVE-2024-45060High 7.1
Unauthenticated Cross-Site-Scripting (XSS) in sample file in PHPSpreadsheet
Affected: from 2.2.0, fixed in 2.3.0; fixed in 1.29.2; from 2.0.0, fixed in 2.1.1.
CVE-2024-45290High 7.7
Path traversal and Server-Side Request Forgery when opening XLSX files in PHPSpreadsheet
Affected: from 2.2.0, fixed in 2.3.0; fixed in 1.29.2; from 2.0.0, fixed in 2.1.1.
CVE-2024-45291Medium 6.3
Path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled in PHPSpreadsheet
Affected: from 2.2.0, fixed in 2.3.0; fixed in 1.29.2; from 2.0.0, fixed in 2.1.1.
CVE-2024-45292Medium 5.4
PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks
Affected: from 2.2.0, fixed in 2.3.0; fixed in 1.29.2; from 2.0.0, fixed in 2.1.1.
CVE-2024-45293High 7.5
XML External Entity Reference (XXE) in PHPSpreadsheet's XLSX reader
Affected: from 2.2.0, fixed in 2.3.0; fixed in 1.29.1; from 2.0.0, fixed in 2.1.1.
CVE-2024-45046Medium 5.4
PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information
Affected: from 2.0.0, fixed in 2.1.0; fixed in 1.29.1.
CVE-2024-45048High 8.8
XML External Entity Reference (XXE) in PHPSpreadsheet
Affected: fixed in 1.29.1; from 2.2.0, fixed in 2.2.1; from 2.0.0, fixed in 2.1.1.
CVE-2020-7776High 7.1
Cross-site Scripting (XSS)
Affected: fixed in 1.16.0.
CVE-2019-12331Unrated
PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue.
Affected: fixed in 1.8.0.
CVE-2018-19277Unrated
securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file
Affected: fixed in 1.5.1.