Phpoffice vulnerabilities
35 CVEs and advisories name Phpoffice as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-108357PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service
- CVE-2026-108359PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)
- CVE-2026-108358PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service
- CVE-2026-108360PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading
- CVE-2026-114404PHPPresentation 1.2.0 XSS via Writer\HTML Text Runs, Hyperlinks and Descriptions
- CVE-2026-114403PHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\Serialized::load
- CVE-2026-59932PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
- CVE-2026-59933PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
- CVE-2026-59931PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
- CVE-2026-45034PhpSpreadsheet: File::prohibitWrappers bypass
- CVE-2026-40863PhpSpreadsheet: CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader
- CVE-2026-40902PhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions
- CVE-2026-40296PhpSpreadsheet vulnerable to XSS in HTML writer via custom number format codes
- CVE-2026-35453PhpSpreadsheet XSS via number format text substitution in HTML Writer
- CVE-2026-34084PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load
- CVE-2025-54370PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser
- CVE-2025-48882PHPOffice Math allows XXE when processing an XML file in the MathML format
- CVE-2025-23210Bypass XSS sanitizer using the javascript protocol and special characters in phpoffice/phpspreadsheet
- CVE-2025-22131Cross-Site Scripting (XSS) vulnerability in generateNavigation() function
- CVE-2024-56412PhpSpreadsheet vulnerable to bypass of the XSS sanitizer using the javascript protocol and special characters
- CVE-2024-56411PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header
- CVE-2024-56410PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability in custom properties
- CVE-2024-56409PhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php file
- CVE-2024-56366PhpSpreadsheet vulnerable to unauthorized reflected XSS in the Accounting.php file
- CVE-2024-56365PhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader class
- CVE-2024-56408PhpSpreadsheet allows unauthorized reflected XSS in `Convert-Online.php` file
- CVE-2024-48917XXE in PHPSpreadsheet's XLSX reader
- CVE-2024-47873PhpSpreadsheet XmlScanner bypass leads to XXE
- CVE-2024-45060Unauthenticated Cross-Site-Scripting (XSS) in sample file in PHPSpreadsheet
- CVE-2024-45290Path traversal and Server-Side Request Forgery when opening XLSX files in PHPSpreadsheet