phpoffice/phpspreadsheet vulnerabilities
PHPSpreadsheet - Read, Create and Write Spreadsheet documents in PHP - Spreadsheet engine
- Registry
- Composer
- Latest
- 5.10.0
- License
- MIT
31 known advisories
The latest version, 5.10.0, is not affected by any of them. Projects on older versions may be.
composer require phpoffice/phpspreadsheet:^5.10.0Security advisories for phpoffice/phpspreadsheet
PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
- Affected
- >=4.0.0 <5.8.1 · >=3.3.0 <3.10.7 · >=2.2.0 <2.4.7 · >=2.0.0 <2.1.18 · <1.30.6
- Fixed in
- 1.30.6, 2.1.18, 2.4.7, 3.10.7, 5.8.1
PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
- Affected
- >=4.0.0 <5.8.1 · >=3.3.0 <3.10.7 · >=2.2.0 <2.4.7 · >=2.0.0 <2.1.18 · <1.30.6
- Fixed in
- 1.30.6, 2.1.18, 2.4.7, 3.10.7, 5.8.1
PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
- Affected
- >=4.0.0 <5.8.1 · >=3.3.0 <3.10.7 · >=2.2.0 <2.4.7 · >=2.0.0 <2.1.18 · <1.30.6
- Fixed in
- 1.30.6, 2.1.18, 2.4.7, 3.10.7, 5.8.1
PHPSpreadsheet has a patch bypass for CVE-2026-34084
- Affected
- <1.30.5
- Fixed in
- 1.30.5
PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions
- Affected
- >=4.0.0 <5.7.0 · >=3.3.0 <3.10.5 · >=2.2.0 <2.4.5 · >=2.0.0 <2.1.16 · <1.30.4
- Fixed in
- 1.30.4, 2.1.16, 2.4.5, 3.10.5, 5.7.0
PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader
- Affected
- >=4.0.0 <5.7.0 · >=3.3.0 <3.10.5 · >=2.2.0 <2.4.5 · >=2.0.0 <2.1.16 · <1.30.4
- Fixed in
- 1.30.4, 2.1.16, 2.4.5, 3.10.5, 5.7.0
PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled
- Affected
- >=4.0.0 <5.6.0 · >=3.3.0 <3.10.4 · >=2.2.0 <2.4.4 · >=2.0.0 <2.1.15 · <1.30.3
- Fixed in
- 1.30.3, 2.1.15, 2.4.4, 3.10.4, 5.6.0
PhpSpreadsheet has XSS via number format code with @ text placeholder bypasses htmlspecialchars in HTML writer
- Affected
- >=4.0.0 <5.7.0 · >=3.3.0 <3.10.5 · >=2.2.0 <2.4.5 · >=2.0.0 <2.1.16 · <1.30.4
- Fixed in
- 1.30.4, 2.1.16, 2.4.5, 3.10.5, 5.7.0
PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer
- Affected
- >=4.0.0 <5.7.0 · >=3.3.0 <3.10.5 · >=2.2.0 <2.4.5 · >=2.0.0 <2.1.16 · <1.30.4
- Fixed in
- 1.30.4, 2.1.16, 2.4.5, 3.10.5, 5.7.0
PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser
- Affected
- <1.30.0 · >=2.0.0 <2.1.12 · >=2.2.0 <2.4.0 · >=3.0.0 <3.10.0 · >=4.0.0 <5.0.0
- Fixed in
- 1.30.0, 2.1.12, 2.4.0, 3.10.0, 5.0.0
PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters
- Affected
- >=3.0.0 <3.9.0 · <1.29.9 · >=2.2.0 <2.3.7 · >=2.0.0 <2.1.8
- Fixed in
- 1.29.9, 2.1.8, 2.3.7, 3.9.0
Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet
- Affected
- >=3.0.0 <3.8.0 · <1.29.8 · >=2.0.0 <2.1.7 · >=2.2.0 <2.3.6
- Fixed in
- 1.29.8, 2.1.7, 2.3.6, 3.8.0
PhpSpreadsheet allows bypass XSS sanitizer using the javascript protocol and special characters
- Affected
- >=3.0.0 <3.7.0 · <1.29.7 · >=2.0.0 <2.1.6 · >=2.2.0 <2.3.5
- Fixed in
- 1.29.7, 2.1.6, 2.3.5, 3.7.0
PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header
- Affected
- >=3.0.0 <3.7.0 · <1.29.7 · >=2.0.0 <2.1.6 · >=2.2.0 <2.3.5
- Fixed in
- 1.29.7, 2.1.6, 2.3.5, 3.7.0
PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability in custom properties
- Affected
- >=3.0.0 <3.7.0 · <1.29.7 · >=2.0.0 <2.1.6 · >=2.2.0 <2.3.5
- Fixed in
- 1.29.7, 2.1.6, 2.3.5, 3.7.0
PhpSpreadsheet allows unauthorized Reflected XSS in Currency.php file
- Affected
- >=3.0.0 <3.7.0 · <1.29.7 · >=2.0.0 <2.1.6 · >=2.2.0 <2.3.5
- Fixed in
- 1.29.7, 2.1.6, 2.3.5, 3.7.0
PhpSpreadsheet allows unauthorized Reflected XSS in the Accounting.php file
- Affected
- >=3.0.0 <3.7.0 · <1.29.7 · >=2.0.0 <2.1.6 · >=2.2.0 <2.3.5
- Fixed in
- 1.29.7, 2.1.6, 2.3.5, 3.7.0
PhpSpreadsheet allows unauthorized Reflected XSS in the constructor of the Downloader class
- Affected
- >=3.0.0 <3.7.0 · <1.29.7 · >=2.0.0 <2.1.6 · >=2.2.0 <2.3.5
- Fixed in
- 1.29.7, 2.1.6, 2.3.5, 3.7.0
PhpSpreadsheet allows unauthorized Reflected XSS in `Convert-Online.php` file
- Affected
- >=3.0.0 <3.7.0 · <1.29.7 · >=2.0.0 <2.1.6 · >=2.2.0 <2.3.5
- Fixed in
- 1.29.7, 2.1.6, 2.3.5, 3.7.0
XXE in PHPSpreadsheet's XLSX reader
- Affected
- <1.29.4 · >=2.0.0 <2.1.3 · >=2.2.0 <2.3.2 · >=3.3.0 <3.4.0
- Fixed in
- 1.29.4, 2.1.3, 2.3.2, 3.4.0
XmlScanner bypass leads to XXE
- Affected
- <1.29.4 · >=2.0.0 <2.1.3 · >=2.2.0 <2.3.2 · >=3.3.0 <3.4.0
- Fixed in
- 1.29.4, 2.1.3, 2.3.2, 3.4.0
XXE in PHPSpreadsheet's XLSX reader
- Affected
- >=2.2.0 <2.3.0 · <1.29.1 · >=2.0.0 <2.1.1
- Fixed in
- 1.29.1, 2.1.1, 2.3.0
PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks
- Affected
- >=2.2.0 <2.3.0 · <1.29.2 · >=2.0.0 <2.1.1
- Fixed in
- 1.29.2, 2.1.1, 2.3.0
PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled
- Affected
- >=2.2.0 <2.3.0 · <1.29.2 · >=2.0.0 <2.1.1
- Fixed in
- 1.29.2, 2.1.1, 2.3.0
PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery when opening XLSX file
- Affected
- >=2.2.0 <2.3.0 · <1.29.2 · >=2.0.0 <2.1.1
- Fixed in
- 1.29.2, 2.1.1, 2.3.0
PhpSpreadsheet has an Unauthenticated Cross-Site-Scripting (XSS) in sample file
- Affected
- >=2.2.0 <2.3.0 · <1.29.2 · >=2.0.0 <2.1.1
- Fixed in
- 1.29.2, 2.1.1, 2.3.0
XXE in PHPSpreadsheet encoding is returned
- Affected
- <1.29.1 · >=2.2.0 <2.2.1 · >=2.0.0 <2.1.1
- Fixed in
- 1.29.1, 2.1.1, 2.2.1
PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information
- Affected
- >=2.0.0 <2.1.0 · <1.29.1
- Fixed in
- 1.29.1, 2.1.0
Cross-site scripting in phpoffice/phpspreadsheet
- Affected
- <1.16.0
- Fixed in
- 1.16.0
XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue
- Affected
- <1.8.0
- Fixed in
- 1.8.0
XXE in PHPSpreadsheet due to encoding issue
- Affected
- <1.5.1
- Fixed in
- 1.5.1
Which of your client projects still run an old phpoffice/phpspreadsheet?
NPMscan reads the composer.lock in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other Composer packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the Composer registry.