# cve.now: Phpoffice

The newest entries naming Phpoffice as an affected vendor (up to 200), of 35 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-108357](https://cve.now/CVE-2026-108357.md): PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service (CVSS 8.8)
- [CVE-2026-108359](https://cve.now/CVE-2026-108359.md): PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS) (CVSS 8.7)
- [CVE-2026-108358](https://cve.now/CVE-2026-108358.md): PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service (CVSS 8.8)
- [CVE-2026-108360](https://cve.now/CVE-2026-108360.md): PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading (CVSS 6.4)
- [CVE-2026-114404](https://cve.now/CVE-2026-114404.md): PHPPresentation 1.2.0 XSS via Writer\\HTML Text Runs, Hyperlinks and Descriptions (CVSS 5.3)
- [CVE-2026-114403](https://cve.now/CVE-2026-114403.md): PHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\\Serialized::load (CVSS 9.2)
- [CVE-2026-59932](https://cve.now/CVE-2026-59932.md): PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion (CVSS 7.5)
- [CVE-2026-59933](https://cve.now/CVE-2026-59933.md): PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion (CVSS 7.5)
- [CVE-2026-59931](https://cve.now/CVE-2026-59931.md): PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist (CVSS 7.7)
- [CVE-2026-45034](https://cve.now/CVE-2026-45034.md): PhpSpreadsheet: File::prohibitWrappers bypass (CVSS 9.2)
- [CVE-2026-40863](https://cve.now/CVE-2026-40863.md): PhpSpreadsheet: CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader (CVSS 7.5)
- [CVE-2026-40902](https://cve.now/CVE-2026-40902.md): PhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions (CVSS 7.5)
- [CVE-2026-40296](https://cve.now/CVE-2026-40296.md): PhpSpreadsheet vulnerable to XSS in HTML writer via custom number format codes (CVSS 5.4)
- [CVE-2026-35453](https://cve.now/CVE-2026-35453.md): PhpSpreadsheet XSS via number format text substitution in HTML Writer (CVSS 4.8)
- [CVE-2026-34084](https://cve.now/CVE-2026-34084.md): PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load (CVSS 9.2)
- [CVE-2025-54370](https://cve.now/CVE-2025-54370.md): PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser (CVSS 8.7)
- [CVE-2025-48882](https://cve.now/CVE-2025-48882.md): PHPOffice Math allows XXE when processing an XML file in the MathML format (CVSS 8.7)
- [CVE-2025-23210](https://cve.now/CVE-2025-23210.md): Bypass XSS sanitizer using the javascript protocol and special characters in phpoffice/phpspreadsheet (CVSS 4.8)
- [CVE-2025-22131](https://cve.now/CVE-2025-22131.md): Cross-Site Scripting (XSS) vulnerability in generateNavigation() function (CVSS 5.1)
- [CVE-2024-56412](https://cve.now/CVE-2024-56412.md): PhpSpreadsheet vulnerable to bypass of the XSS sanitizer using the javascript protocol and special characters (CVSS 4.8)
- [CVE-2024-56411](https://cve.now/CVE-2024-56411.md): PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header (CVSS 4.8)
- [CVE-2024-56410](https://cve.now/CVE-2024-56410.md): PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability in custom properties (CVSS 4.8)
- [CVE-2024-56409](https://cve.now/CVE-2024-56409.md): PhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php file (CVSS 8.3)
- [CVE-2024-56366](https://cve.now/CVE-2024-56366.md): PhpSpreadsheet vulnerable to unauthorized reflected XSS in the Accounting.php file (CVSS 8.3)
- [CVE-2024-56365](https://cve.now/CVE-2024-56365.md): PhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader class (CVSS 8.3)
- [CVE-2024-56408](https://cve.now/CVE-2024-56408.md): PhpSpreadsheet allows unauthorized reflected XSS in \`Convert-Online.php\` file (CVSS 8.3)
- [CVE-2024-48917](https://cve.now/CVE-2024-48917.md): XXE in PHPSpreadsheet's XLSX reader (CVSS 7.5)
- [CVE-2024-47873](https://cve.now/CVE-2024-47873.md): PhpSpreadsheet XmlScanner bypass leads to XXE (CVSS 7.5)
- [CVE-2024-45060](https://cve.now/CVE-2024-45060.md): Unauthenticated Cross-Site-Scripting (XSS) in sample file in PHPSpreadsheet (CVSS 7.1)
- [CVE-2024-45290](https://cve.now/CVE-2024-45290.md): Path traversal and Server-Side Request Forgery when opening XLSX files in PHPSpreadsheet (CVSS 7.7)
- [CVE-2024-45291](https://cve.now/CVE-2024-45291.md): Path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled in PHPSpreadsheet (CVSS 6.3)
- [CVE-2024-45292](https://cve.now/CVE-2024-45292.md): PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks (CVSS 5.4)
- [CVE-2024-45293](https://cve.now/CVE-2024-45293.md): XML External Entity Reference (XXE) in PHPSpreadsheet's XLSX reader (CVSS 7.5)
- [CVE-2024-45046](https://cve.now/CVE-2024-45046.md): PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information (CVSS 5.4)
- [CVE-2024-45048](https://cve.now/CVE-2024-45048.md): XML External Entity Reference (XXE) in PHPSpreadsheet (CVSS 8.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/phpoffice
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.