Is phpoffice/phpspreadsheet 5.8 vulnerable?
Composer · 2 releases from 5.8.0 to 5.8.1 · latest phpoffice/phpspreadsheet is 5.10.0 · checked 2 Nov 2026
Yes: 4 known advisories
Yes. phpoffice/phpspreadsheet 5.8.1, the last 5.8 release, is affected by 4 known security advisories (3 high, 1 medium), including CVE-2026-108359, CVE-2026-108358, CVE-2026-108357. 3 more affect earlier 5.8.x releases. Upgrade to 5.10.0 or later to fix all of them.
composer require phpoffice/phpspreadsheet:^5.10.0Advisories affecting phpoffice/phpspreadsheet 5.8.1
PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading
- Affected
- >=4.0.0 <5.10.0 · >=3.3.0 <3.10.8 · >=2.2.0 <2.4.8 · >=2.0.0 <2.1.19 · <1.30.7
- Fixed in
- 1.30.7, 2.1.19, 2.4.8, 3.10.8, 5.10.0
PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)
- Affected
- >=4.0.0 <5.10.0 · >=3.3.0 <3.10.8 · >=2.2.0 <2.4.8 · >=2.0.0 <2.1.19 · <1.30.7
- Fixed in
- 1.30.7, 2.1.19, 2.4.8, 3.10.8, 5.10.0
PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service
- Affected
- >=4.0.0 <5.10.0 · >=3.3.0 <3.10.8 · >=2.2.0 <2.4.8 · >=2.0.0 <2.1.19 · <1.30.7
- Fixed in
- 1.30.7, 2.1.19, 2.4.8, 3.10.8, 5.10.0
PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service
- Affected
- >=4.0.0 <5.10.0 · >=3.3.0 <3.10.8
- Fixed in
- 3.10.8, 5.10.0
Fixed within 5.8.x, affecting earlier releases
PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
- Affected
- >=4.0.0 <5.8.1 · >=3.3.0 <3.10.7 · >=2.2.0 <2.4.7 · >=2.0.0 <2.1.18 · <1.30.6
- Fixed in
- 1.30.6, 2.1.18, 2.4.7, 3.10.7, 5.8.1
PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
- Affected
- >=4.0.0 <5.8.1 · >=3.3.0 <3.10.7 · >=2.2.0 <2.4.7 · >=2.0.0 <2.1.18 · <1.30.6
- Fixed in
- 1.30.6, 2.1.18, 2.4.7, 3.10.7, 5.8.1
PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
- Affected
- >=4.0.0 <5.8.1 · >=3.3.0 <3.10.7 · >=2.2.0 <2.4.7 · >=2.0.0 <2.1.18 · <1.30.6
- Fixed in
- 1.30.6, 2.1.18, 2.4.7, 3.10.7, 5.8.1
Which of your client projects are still on phpoffice/phpspreadsheet 5.8?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact phpoffice/phpspreadsheet version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other phpoffice/phpspreadsheet versions
- phpoffice/phpspreadsheet 5.10
- phpoffice/phpspreadsheet 5.9
- phpoffice/phpspreadsheet 5.7
- phpoffice/phpspreadsheet 5.6
- phpoffice/phpspreadsheet 5.5
- phpoffice/phpspreadsheet 4.5
- phpoffice/phpspreadsheet 4.4
- phpoffice/phpspreadsheet 4.3
- phpoffice/phpspreadsheet 4.2
- phpoffice/phpspreadsheet 4.1
- phpoffice/phpspreadsheet 4.0
- phpoffice/phpspreadsheet 3.10
- All phpoffice/phpspreadsheet advisories
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.