Is phpoffice/phpspreadsheet 1.25 vulnerable?
Composer · 3 releases from 1.25.0 to 1.25.2 · latest phpoffice/phpspreadsheet is 5.10.0 · checked 2 Nov 2026
Yes: 31 known advisories
Yes. phpoffice/phpspreadsheet 1.25.2, the last 1.25 release, is affected by 31 known security advisories (2 critical, 17 high, 12 medium), including CVE-2026-45034, CVE-2026-34084, CVE-2026-108359. Upgrade to 1.30.7 or later to fix all of them.
composer require phpoffice/phpspreadsheet:^1.30.7Advisories affecting phpoffice/phpspreadsheet 1.25.2
PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading
- Affected
- >=4.0.0 <5.10.0 · >=3.3.0 <3.10.8 · >=2.2.0 <2.4.8 · >=2.0.0 <2.1.19 · <1.30.7
- Fixed in
- 1.30.7, 2.1.19, 2.4.8, 3.10.8, 5.10.0
PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)
- Affected
- >=4.0.0 <5.10.0 · >=3.3.0 <3.10.8 · >=2.2.0 <2.4.8 · >=2.0.0 <2.1.19 · <1.30.7
- Fixed in
- 1.30.7, 2.1.19, 2.4.8, 3.10.8, 5.10.0
PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service
- Affected
- >=4.0.0 <5.10.0 · >=3.3.0 <3.10.8 · >=2.2.0 <2.4.8 · >=2.0.0 <2.1.19 · <1.30.7
- Fixed in
- 1.30.7, 2.1.19, 2.4.8, 3.10.8, 5.10.0
PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
- Affected
- >=4.0.0 <5.8.1 · >=3.3.0 <3.10.7 · >=2.2.0 <2.4.7 · >=2.0.0 <2.1.18 · <1.30.6
- Fixed in
- 1.30.6, 2.1.18, 2.4.7, 3.10.7, 5.8.1
PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
- Affected
- >=4.0.0 <5.8.1 · >=3.3.0 <3.10.7 · >=2.2.0 <2.4.7 · >=2.0.0 <2.1.18 · <1.30.6
- Fixed in
- 1.30.6, 2.1.18, 2.4.7, 3.10.7, 5.8.1
PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
- Affected
- >=4.0.0 <5.8.1 · >=3.3.0 <3.10.7 · >=2.2.0 <2.4.7 · >=2.0.0 <2.1.18 · <1.30.6
- Fixed in
- 1.30.6, 2.1.18, 2.4.7, 3.10.7, 5.8.1
PHPSpreadsheet has a patch bypass for CVE-2026-34084
- Affected
- <1.30.5
- Fixed in
- 1.30.5
PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions
- Affected
- >=4.0.0 <5.7.0 · >=3.3.0 <3.10.5 · >=2.2.0 <2.4.5 · >=2.0.0 <2.1.16 · <1.30.4
- Fixed in
- 1.30.4, 2.1.16, 2.4.5, 3.10.5, 5.7.0
PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader
- Affected
- >=4.0.0 <5.7.0 · >=3.3.0 <3.10.5 · >=2.2.0 <2.4.5 · >=2.0.0 <2.1.16 · <1.30.6
- Fixed in
- 1.30.6, 2.1.16, 2.4.5, 3.10.5, 5.7.0
PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled
- Affected
- >=4.0.0 <5.6.0 · >=3.3.0 <3.10.4 · >=2.2.0 <2.4.4 · >=2.0.0 <2.1.15 · <1.30.3
- Fixed in
- 1.30.3, 2.1.15, 2.4.4, 3.10.4, 5.6.0
PhpSpreadsheet has XSS via number format code with @ text placeholder bypasses htmlspecialchars in HTML writer
- Affected
- >=4.0.0 <5.7.0 · >=3.3.0 <3.10.5 · >=2.2.0 <2.4.5 · >=2.0.0 <2.1.16 · <1.30.4
- Fixed in
- 1.30.4, 2.1.16, 2.4.5, 3.10.5, 5.7.0
PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer
- Affected
- >=4.0.0 <5.7.0 · >=3.3.0 <3.10.5 · >=2.2.0 <2.4.5 · >=2.0.0 <2.1.16 · <1.30.4
- Fixed in
- 1.30.4, 2.1.16, 2.4.5, 3.10.5, 5.7.0
PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser
- Affected
- <1.30.0 · >=2.0.0 <2.1.12 · >=2.2.0 <2.4.0 · >=3.0.0 <3.10.0 · >=4.0.0 <5.0.0
- Fixed in
- 1.30.0, 2.1.12, 2.4.0, 3.10.0, 5.0.0
PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters
- Affected
- >=3.0.0 <3.9.0 · <1.29.9 · >=2.2.0 <2.3.7 · >=2.0.0 <2.1.8
- Fixed in
- 1.29.9, 2.1.8, 2.3.7, 3.9.0
Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet
- Affected
- >=3.0.0 <3.8.0 · <1.29.8 · >=2.0.0 <2.1.7 · >=2.2.0 <2.3.6
- Fixed in
- 1.29.8, 2.1.7, 2.3.6, 3.8.0
PhpSpreadsheet allows bypass XSS sanitizer using the javascript protocol and special characters
- Affected
- >=3.0.0 <3.7.0 · <1.29.7 · >=2.0.0 <2.1.6 · >=2.2.0 <2.3.5
- Fixed in
- 1.29.7, 2.1.6, 2.3.5, 3.7.0
PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header
- Affected
- >=3.0.0 <3.7.0 · <1.29.7 · >=2.0.0 <2.1.6 · >=2.2.0 <2.3.5
- Fixed in
- 1.29.7, 2.1.6, 2.3.5, 3.7.0
PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability in custom properties
- Affected
- >=3.0.0 <3.7.0 · <1.29.7 · >=2.0.0 <2.1.6 · >=2.2.0 <2.3.5
- Fixed in
- 1.29.7, 2.1.6, 2.3.5, 3.7.0
PhpSpreadsheet allows unauthorized Reflected XSS in Currency.php file
- Affected
- >=3.0.0 <3.7.0 · <1.29.7 · >=2.0.0 <2.1.6 · >=2.2.0 <2.3.5
- Fixed in
- 1.29.7, 2.1.6, 2.3.5, 3.7.0
PhpSpreadsheet allows unauthorized Reflected XSS in the Accounting.php file
- Affected
- >=3.0.0 <3.7.0 · <1.29.7 · >=2.0.0 <2.1.6 · >=2.2.0 <2.3.5
- Fixed in
- 1.29.7, 2.1.6, 2.3.5, 3.7.0
PhpSpreadsheet allows unauthorized Reflected XSS in the constructor of the Downloader class
- Affected
- >=3.0.0 <3.7.0 · <1.29.7 · >=2.0.0 <2.1.6 · >=2.2.0 <2.3.5
- Fixed in
- 1.29.7, 2.1.6, 2.3.5, 3.7.0
PhpSpreadsheet allows unauthorized Reflected XSS in `Convert-Online.php` file
- Affected
- >=3.0.0 <3.7.0 · <1.29.7 · >=2.0.0 <2.1.6 · >=2.2.0 <2.3.5
- Fixed in
- 1.29.7, 2.1.6, 2.3.5, 3.7.0
XXE in PHPSpreadsheet's XLSX reader
- Affected
- <1.29.4 · >=2.0.0 <2.1.3 · >=2.2.0 <2.3.2 · >=3.3.0 <3.4.0
- Fixed in
- 1.29.4, 2.1.3, 2.3.2, 3.4.0
XmlScanner bypass leads to XXE
- Affected
- <1.29.4 · >=2.0.0 <2.1.3 · >=2.2.0 <2.3.2 · >=3.3.0 <3.4.0
- Fixed in
- 1.29.4, 2.1.3, 2.3.2, 3.4.0
XXE in PHPSpreadsheet's XLSX reader
- Affected
- >=2.2.0 <2.3.0 · <1.29.1 · >=2.0.0 <2.1.1
- Fixed in
- 1.29.1, 2.1.1, 2.3.0
PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks
- Affected
- >=2.2.0 <2.3.0 · <1.29.2 · >=2.0.0 <2.1.1
- Fixed in
- 1.29.2, 2.1.1, 2.3.0
PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled
- Affected
- >=2.2.0 <2.3.0 · <1.29.2 · >=2.0.0 <2.1.1
- Fixed in
- 1.29.2, 2.1.1, 2.3.0
PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery when opening XLSX file
- Affected
- >=2.2.0 <2.3.0 · <1.29.2 · >=2.0.0 <2.1.1
- Fixed in
- 1.29.2, 2.1.1, 2.3.0
PhpSpreadsheet has an Unauthenticated Cross-Site-Scripting (XSS) in sample file
- Affected
- >=2.2.0 <2.3.0 · <1.29.2 · >=2.0.0 <2.1.1
- Fixed in
- 1.29.2, 2.1.1, 2.3.0
XXE in PHPSpreadsheet encoding is returned
- Affected
- <1.29.1 · >=2.2.0 <2.2.1 · >=2.0.0 <2.1.1
- Fixed in
- 1.29.1, 2.1.1, 2.2.1
PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information
- Affected
- >=2.0.0 <2.1.0 · <1.29.1
- Fixed in
- 1.29.1, 2.1.0
Which of your client projects are still on phpoffice/phpspreadsheet 1.25?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact phpoffice/phpspreadsheet version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other phpoffice/phpspreadsheet versions
- phpoffice/phpspreadsheet 1.28
- phpoffice/phpspreadsheet 1.27
- phpoffice/phpspreadsheet 1.26
- phpoffice/phpspreadsheet 1.24
- phpoffice/phpspreadsheet 1.23
- phpoffice/phpspreadsheet 1.22
- phpoffice/phpspreadsheet 5.10
- phpoffice/phpspreadsheet 5.9
- phpoffice/phpspreadsheet 5.8
- phpoffice/phpspreadsheet 5.7
- phpoffice/phpspreadsheet 5.6
- phpoffice/phpspreadsheet 5.5
- All phpoffice/phpspreadsheet advisories
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.