PHP package security
Is phpoffice/phpspreadsheet vulnerable?
35 known security advisories for phpoffice/phpspreadsheet. The latest was reported on 2026-10-27 and names no fixed version. The newest release, 5.10.0, is not affected by any of them.
2 critical 20 high 13 medium
- Known advisories
- 35
- Newest release
- 5.10.0
- Released
- 2026-09-17
- Affecting newest release
- 0
- Last synced
- 2026-11-03
Check your version
Security advisories for phpoffice/phpspreadsheet
| Reported | Advisory | Severity | Affected | Fixed in |
|---|---|---|---|---|
| 2026-10-27 | PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading GHSA-2phh-27fw-q4gc · CVE-2026-108360 · GitHub | medium | <=1.30.6 | >=2.0.0,<=2.1.18 | >=2.2.0,<=2.4.7 | >=3.3.0,<=3.10.7 | >=4.0.0,<=5.9.0 | not stated |
| 2026-10-27 | PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS) GHSA-j2w7-387v-m2rq · CVE-2026-108359 · GitHub | high | <=1.30.6 | >=2.0.0,<=2.1.18 | >=2.2.0,<=2.4.7 | >=3.3.0,<=3.10.7 | >=4.0.0,<=5.9.0 | not stated |
| 2026-10-27 | PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service GHSA-3x94-m842-937c · CVE-2026-108358 · GitHub | high | <=1.30.6 | >=2.0.0,<=2.1.18 | >=2.2.0,<=2.4.7 | >=3.3.0,<=3.10.7 | >=4.0.0,<=5.9.0 | not stated |
| 2026-10-27 | PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service GHSA-rxj4-h86g-25gc · CVE-2026-108357 · GitHub | high | >=3.3.0,<=3.10.7 | >=4.0.0,<=5.9.0 | not stated |
| 2026-07-23 | PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion GHSA-xh5m-36r6-47m3 · CVE-2026-59933 · GitHub | high | <=1.30.5 | >=2.0.0,<=2.1.17 | >=2.2.0,<=2.4.6 | >=3.3.0,<=3.10.6 | >=4.0.0,<=5.8.0 | not stated |
| 2026-07-23 | PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion GHSA-2mrg-gjxq-2gvr · CVE-2026-59932 · GitHub | high | <=1.30.5 | >=2.0.0,<=2.1.17 | >=2.2.0,<=2.4.6 | >=3.3.0,<=3.10.6 | >=4.0.0,<=5.8.0 | not stated |
| 2026-07-23 | PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist GHSA-6hq5-7373-42rg · CVE-2026-59931 · GitHub | high | <=1.30.5 | >=2.0.0,<=2.1.17 | >=2.2.0,<=2.4.6 | >=3.3.0,<=3.10.6 | >=4.0.0,<=5.8.0 | not stated |
| 2026-06-08 | PHPSpreadsheet has a patch bypass for CVE-2026-34084 GHSA-87m4-826x-3crx · CVE-2026-45034 · GitHub | critical | <=1.30.4 | not stated |
| 2026-04-29 | PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions GHSA-7c6m-4442-2x6m · CVE-2026-40902 · GitHub | high | <=1.30.3 | >=2.0.0,<=2.1.15 | >=2.2.0,<=2.4.4 | >=3.3.0,<=3.10.4 | >=4.0.0,<=5.6.0 | not stated |
| 2026-04-29 | PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader GHSA-84wq-86v6-x5j6 · CVE-2026-40863 · GitHub | high | <=1.30.5 | >=2.0.0,<=2.1.15 | >=2.2.0,<=2.4.4 | >=3.3.0,<=3.10.4 | >=4.0.0,<=5.6.0 | not stated |
| 2026-04-29 | PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled GHSA-q4q6-r8wh-5cgh · CVE-2026-34084 · GitHub | critical | <=1.30.2 | >=2.0.0,<=2.1.14 | >=2.2.0,<=2.4.3 | >=3.3.0,<=3.10.3 | >=4.0.0,<=5.5.0 | not stated |
| 2026-04-28 | PhpSpreadsheet has XSS via number format code with @ text placeholder bypasses htmlspecialchars in HTML writer GHSA-hrmw-qprp-wgmc · CVE-2026-40296 · GitHub | medium | <=1.30.3 | >=2.0.0,<=2.1.15 | >=2.2.0,<=2.4.4 | >=3.3.0,<=3.10.4 | >=4.0.0,<=5.6.0 | not stated |
| 2026-04-28 | PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer GHSA-6wpp-88cp-7q68 · CVE-2026-35453 · GitHub | medium | <=1.30.3 | >=2.0.0,<=2.1.15 | >=2.2.0,<=2.4.4 | >=3.3.0,<=3.10.4 | >=4.0.0,<=5.6.0 | not stated |
| 2025-08-03 | PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser CVE-2025-54370 · GitHub, FriendsOfPHP/security-advisories | high | <1.30.0 | >=2.0.0,<2.1.0 | >=2.1.0,<2.1.12 | >=2.2.0,<2.3.0 | >=2.3.0,<2.4.0 | >=3.0.0,<3.10.0 | >=4.0.0,<5.0.0 | 1.30.0, 2.1.0, 2.1.12, 2.3.0, 2.4.0, 3.10.0, 5.0.0 |
| 2025-02-03 | PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters GHSA-r57h-547h-w24f · CVE-2025-23210 · GitHub | medium | >=2.0.0,<2.1.8 | >=2.2.0,<2.3.7 | <1.29.9 | >=3.0.0,<3.9.0 | 1.29.9, 2.1.8, 2.3.7, 3.9.0 |
| 2025-01-21 | Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet GHSA-79xx-vf93-p7cx · CVE-2025-22131 · GitHub | medium | >=2.2.0,<2.3.6 | >=2.0.0,<2.1.7 | <1.29.8 | >=3.0.0,<3.8.0 | 1.29.8, 2.1.7, 2.3.6, 3.8.0 |
| 2025-01-03 | PhpSpreadsheet allows bypass XSS sanitizer using the javascript protocol and special characters GHSA-q9jv-mm3r-j47r · CVE-2024-56412 · GitHub | medium | >=2.2.0,<=2.3.4 | >=2.0.0,<=2.1.5 | <=1.29.6 | >=3.0.0,<3.7.0 | 3.7.0 |
| 2025-01-03 | PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header GHSA-hwcp-2h35-p66w · CVE-2024-56411 · GitHub | medium | >=2.2.0,<=2.3.4 | >=2.0.0,<=2.1.5 | <=1.29.6 | >=3.0.0,<3.7.0 | 3.7.0 |
| 2025-01-03 | PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability in custom properties GHSA-wv23-996v-q229 · CVE-2024-56410 · GitHub | medium | >=2.2.0,<=2.3.4 | >=2.0.0,<=2.1.5 | <=1.29.6 | >=3.0.0,<3.7.0 | 3.7.0 |
| 2025-01-03 | PhpSpreadsheet allows unauthorized Reflected XSS in Currency.php file GHSA-j2xg-cjcx-4677 · CVE-2024-56409 · GitHub | high | >=2.2.0,<=2.3.4 | >=2.0.0,<=2.1.5 | <=1.29.6 | >=3.0.0,<3.7.0 | 3.7.0 |
| 2025-01-03 | PhpSpreadsheet allows unauthorized Reflected XSS in the Accounting.php file GHSA-c6fv-7vh8-2rhr · CVE-2024-56366 · GitHub | high | >=2.2.0,<=2.3.4 | >=2.0.0,<=2.1.5 | <=1.29.6 | >=3.0.0,<3.7.0 | 3.7.0 |
| 2025-01-03 | PhpSpreadsheet allows unauthorized Reflected XSS in the constructor of the Downloader class GHSA-jmpx-686v-c3wx · CVE-2024-56365 · GitHub | high | >=2.2.0,<=2.3.4 | >=2.0.0,<=2.1.5 | <=1.29.6 | >=3.0.0,<3.7.0 | 3.7.0 |
| 2025-01-03 | PhpSpreadsheet allows unauthorized Reflected XSS in `Convert-Online.php` file GHSA-x88g-h956-m5xg · CVE-2024-56408 · GitHub | high | >=2.2.0,<=2.3.4 | >=2.0.0,<=2.1.5 | <=1.29.6 | >=3.0.0,<3.7.0 | 3.7.0 |
| 2024-11-18 | XXE in PHPSpreadsheet's XLSX reader GHSA-7cc9-j4mv-vcjp · CVE-2024-48917 · GitHub | high | >=3.3.0,<3.4.0 | >=2.2.0,<2.3.2 | >=2.0.0,<2.1.3 | <1.29.4 | 1.29.4, 2.1.3, 2.3.2, 3.4.0 |
| 2024-11-18 | XmlScanner bypass leads to XXE GHSA-jw4x-v69f-hh5w · CVE-2024-47873 · GitHub | high | >=3.3.0,<3.4.0 | >=2.2.0,<2.3.2 | >=2.0.0,<2.1.3 | <1.29.4 | 1.29.4, 2.1.3, 2.3.2, 3.4.0 |
| 2024-10-07 | XXE in PHPSpreadsheet's XLSX reader GHSA-6hwr-6v2f-3m88 · CVE-2024-45293 · GitHub | high | >=2.0.0,<2.1.1 | <1.29.1 | >=2.2.0,<2.3.0 | 1.29.1, 2.1.1, 2.3.0 |
| 2024-10-07 | PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks GHSA-r8w8-74ww-j4wh · CVE-2024-45292 · GitHub | medium | >=2.0.0,<2.1.1 | <1.29.2 | >=2.2.0,<2.3.0 | 1.29.2, 2.1.1, 2.3.0 |
| 2024-10-07 | PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled GHSA-w9xv-qf98-ccq4 · CVE-2024-45291 · GitHub | medium | >=2.0.0,<2.1.1 | <1.29.2 | >=2.2.0,<2.3.0 | 1.29.2, 2.1.1, 2.3.0 |
| 2024-10-07 | PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery when opening XLSX file GHSA-5gpr-w2p5-6m37 · CVE-2024-45290 · GitHub | high | >=2.0.0,<2.1.1 | <1.29.2 | >=2.2.0,<2.3.0 | 1.29.2, 2.1.1, 2.3.0 |
| 2024-10-07 | PhpSpreadsheet has an Unauthenticated Cross-Site-Scripting (XSS) in sample file GHSA-v66g-p9x6-v98p · CVE-2024-45060 · GitHub | medium | >=2.0.0,<2.1.1 | <1.29.2 | >=2.2.0,<2.3.0 | 1.29.2, 2.1.1, 2.3.0 |
| 2024-08-29 | XXE in PHPSpreadsheet encoding is returned GHSA-ghg6-32f9-2jp7 · CVE-2024-45048 · GitHub | high | >=2.0.0,<2.1.1 | >=2.2.0,<2.2.1 | <1.29.1 | 1.29.1, 2.1.1, 2.2.1 |
| 2024-08-29 | PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information GHSA-wgmf-q9vr-vww6 · CVE-2024-45046 · GitHub | medium | <1.29.1 | >=2.0.0,<2.1.0 | 1.29.1, 2.1.0 |
| 2020-12-31 | XSS Vulnerability in HTML Writer CVE-2020-7776 · GitHub, FriendsOfPHP/security-advisories | medium | <1.16.0 | 1.16.0 |
| 2019-07-01 | XXE Vulnerability CVE-2019-12331 · GitHub, FriendsOfPHP/security-advisories | high | <1.8.0 | 1.8.0 |
| 2018-11-20 | XXE Vulnerability CVE-2018-19277 · GitHub, FriendsOfPHP/security-advisories | high | <1.5.1 | 1.5.1 |
Need help patching or upgrading? Laskyr does PHP and Laravel security fixes and upgrades. Tell us what you run and we reply with a plan and a price.
Ask about a fixCheck your whole project. Paste your composer.lock and see every installed package with a known advisory. Nothing is stored.
Check composer.lockQuestions about phpoffice/phpspreadsheet
Does phpoffice/phpspreadsheet have known vulnerabilities?
Yes. Packagist lists 35 security advisories for phpoffice/phpspreadsheet (2 critical, 20 high, 13 medium severity). The most recent, reported 2026-10-27, is "PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading". The newest release, 5.10.0, is outside every affected range.
Which version of phpoffice/phpspreadsheet should I run?
The newest stable release is 5.10.0 (published 2026-09-17). Run composer update phpoffice/phpspreadsheet, then composer audit to confirm nothing else is flagged.
How do I check if my phpoffice/phpspreadsheet version is affected?
Run composer show phpoffice/phpspreadsheet in your project to see the installed version, then enter it in the version check on this page. You can also run composer audit, which reads the same Packagist advisory data for every package in your composer.lock.