phpoffice/phpspreadsheet Security Advisories for 3.9.0 (13)
-
[MEDIUM] PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading
PKSA-r15m-kszr-8n8q CVE-2026-108360 GHSA-2phh-27fw-q4gc
Affected version: <=1.30.6|>=2.0.0,<=2.1.18|>=2.2.0,<=2.4.7|>=3.3.0,<=3.10.7|>=4.0.0,<=5.9.0
Reported by:
GitHub -
[HIGH] PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)
PKSA-dxd5-wy68-pq29 CVE-2026-108359 GHSA-j2w7-387v-m2rq
Affected version: <=1.30.6|>=2.0.0,<=2.1.18|>=2.2.0,<=2.4.7|>=3.3.0,<=3.10.7|>=4.0.0,<=5.9.0
Reported by:
GitHub -
[HIGH] PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service
PKSA-96jv-mtjg-g2v8 CVE-2026-108358 GHSA-3x94-m842-937c
Affected version: <=1.30.6|>=2.0.0,<=2.1.18|>=2.2.0,<=2.4.7|>=3.3.0,<=3.10.7|>=4.0.0,<=5.9.0
Reported by:
GitHub -
[HIGH] PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service
PKSA-zb3c-6qhx-m249 CVE-2026-108357 GHSA-rxj4-h86g-25gc
Affected version: >=3.3.0,<=3.10.7|>=4.0.0,<=5.9.0
Reported by:
GitHub -
[HIGH] PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
PKSA-r22k-87hv-mfk4 CVE-2026-59933 GHSA-xh5m-36r6-47m3
Affected version: <=1.30.5|>=2.0.0,<=2.1.17|>=2.2.0,<=2.4.6|>=3.3.0,<=3.10.6|>=4.0.0,<=5.8.0
Reported by:
GitHub -
[HIGH] PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
PKSA-m9cr-9614-rsf7 CVE-2026-59932 GHSA-2mrg-gjxq-2gvr
Affected version: <=1.30.5|>=2.0.0,<=2.1.17|>=2.2.0,<=2.4.6|>=3.3.0,<=3.10.6|>=4.0.0,<=5.8.0
Reported by:
GitHub -
[HIGH] PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
PKSA-dqzt-yst9-1w9y CVE-2026-59931 GHSA-6hq5-7373-42rg
Affected version: <=1.30.5|>=2.0.0,<=2.1.17|>=2.2.0,<=2.4.6|>=3.3.0,<=3.10.6|>=4.0.0,<=5.8.0
Reported by:
GitHub -
[HIGH] PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions
PKSA-gz3f-3cz3-3wsw CVE-2026-40902 GHSA-7c6m-4442-2x6m
Affected version: <=1.30.3|>=2.0.0,<=2.1.15|>=2.2.0,<=2.4.4|>=3.3.0,<=3.10.4|>=4.0.0,<=5.6.0
Reported by:
GitHub -
[HIGH] PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader
PKSA-x13r-n4wc-4gcr CVE-2026-40863 GHSA-84wq-86v6-x5j6
Affected version: <=1.30.5|>=2.0.0,<=2.1.15|>=2.2.0,<=2.4.4|>=3.3.0,<=3.10.4|>=4.0.0,<=5.6.0
Reported by:
GitHub -
[CRITICAL] PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled
PKSA-8cfg-tzhf-fr83 CVE-2026-34084 GHSA-q4q6-r8wh-5cgh
Affected version: <=1.30.2|>=2.0.0,<=2.1.14|>=2.2.0,<=2.4.3|>=3.3.0,<=3.10.3|>=4.0.0,<=5.5.0
Reported by:
GitHub -
[MEDIUM] PhpSpreadsheet has XSS via number format code with @ text placeholder bypasses htmlspecialchars in HTML writer
PKSA-hznc-gbby-6w16 CVE-2026-40296 GHSA-hrmw-qprp-wgmc
Affected version: <=1.30.3|>=2.0.0,<=2.1.15|>=2.2.0,<=2.4.4|>=3.3.0,<=3.10.4|>=4.0.0,<=5.6.0
Reported by:
GitHub -
[MEDIUM] PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer
PKSA-jtdk-dcr5-f11n CVE-2026-35453 GHSA-6wpp-88cp-7q68
Affected version: <=1.30.3|>=2.0.0,<=2.1.15|>=2.2.0,<=2.4.4|>=3.3.0,<=3.10.4|>=4.0.0,<=5.6.0
Reported by:
GitHub -
[HIGH] PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser
PKSA-64jn-3d9t-gncx CVE-2025-54370 GHSA-rx7m-68vc-ppxh
Affected version: <1.30.0|>=2.0.0,<2.1.0|>=2.1.0,<2.1.12|>=2.2.0,<2.3.0|>=2.3.0,<2.4.0|>=3.0.0,<3.10.0|>=4.0.0,<5.0.0
Reported by:
GitHub, FriendsOfPHP/security-advisories