Security Advisories - phpoffice/phpspreadsheet

phpoffice/phpspreadsheet Security Advisories for 2.2.0 (26)

[HIGH] PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion

PKSA-r22k-87hv-mfk4 CVE-2026-59933 GHSA-xh5m-36r6-47m3

Affected version: <=1.30.5|>=2.0.0,<=2.1.17|>=2.2.0,<=2.4.6|>=3.3.0,<=3.10.6|>=4.0.0,<=5.8.0

Reported by:
GitHub
[HIGH] PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion

PKSA-m9cr-9614-rsf7 CVE-2026-59932 GHSA-2mrg-gjxq-2gvr

Affected version: <=1.30.5|>=2.0.0,<=2.1.17|>=2.2.0,<=2.4.6|>=3.3.0,<=3.10.6|>=4.0.0,<=5.8.0

Reported by:
GitHub
[HIGH] PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist

PKSA-dqzt-yst9-1w9y CVE-2026-59931 GHSA-6hq5-7373-42rg

Affected version: <=1.30.5|>=2.0.0,<=2.1.17|>=2.2.0,<=2.4.6|>=3.3.0,<=3.10.6|>=4.0.0,<=5.8.0

Reported by:
GitHub
[HIGH] PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions

PKSA-gz3f-3cz3-3wsw CVE-2026-40902 GHSA-7c6m-4442-2x6m

Affected version: <=1.30.3|>=2.0.0,<=2.1.15|>=2.2.0,<=2.4.4|>=3.3.0,<=3.10.4|>=4.0.0,<=5.6.0

Reported by:
GitHub
[HIGH] PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader

PKSA-x13r-n4wc-4gcr CVE-2026-40863 GHSA-84wq-86v6-x5j6

Affected version: <=1.30.3|>=2.0.0,<=2.1.15|>=2.2.0,<=2.4.4|>=3.3.0,<=3.10.4|>=4.0.0,<=5.6.0

Reported by:
GitHub
[CRITICAL] PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled

PKSA-8cfg-tzhf-fr83 CVE-2026-34084 GHSA-q4q6-r8wh-5cgh

Affected version: <=1.30.2|>=2.0.0,<=2.1.14|>=2.2.0,<=2.4.3|>=3.3.0,<=3.10.3|>=4.0.0,<=5.5.0

Reported by:
GitHub
[MEDIUM] PhpSpreadsheet has XSS via number format code with @ text placeholder bypasses htmlspecialchars in HTML writer

PKSA-hznc-gbby-6w16 CVE-2026-40296 GHSA-hrmw-qprp-wgmc

Affected version: <=1.30.3|>=2.0.0,<=2.1.15|>=2.2.0,<=2.4.4|>=3.3.0,<=3.10.4|>=4.0.0,<=5.6.0

Reported by:
GitHub
[MEDIUM] PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer

PKSA-jtdk-dcr5-f11n CVE-2026-35453 GHSA-6wpp-88cp-7q68

Affected version: <=1.30.3|>=2.0.0,<=2.1.15|>=2.2.0,<=2.4.4|>=3.3.0,<=3.10.4|>=4.0.0,<=5.6.0

Reported by:
GitHub
[HIGH] PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser

PKSA-64jn-3d9t-gncx CVE-2025-54370 GHSA-rx7m-68vc-ppxh

Affected version: <1.30.0|>=2.0.0,<2.1.0|>=2.1.0,<2.1.12|>=2.2.0,<2.3.0|>=2.3.0,<2.4.0|>=3.0.0,<3.10.0|>=4.0.0,<5.0.0

Reported by:
GitHub, FriendsOfPHP/security-advisories
[MEDIUM] PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters

PKSA-8b16-mcgz-h4cz CVE-2025-23210 GHSA-r57h-547h-w24f

Affected version: >=2.0.0,<2.1.8|>=2.2.0,<2.3.7|<1.29.9|>=3.0.0,<3.9.0

Reported by:
GitHub
[MEDIUM] Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet

PKSA-s99r-9yxm-hjvt CVE-2025-22131 GHSA-79xx-vf93-p7cx

Affected version: >=2.2.0,<2.3.6|>=2.0.0,<2.1.7|<1.29.8|>=3.0.0,<3.8.0

Reported by:
GitHub
[MEDIUM] PhpSpreadsheet allows bypass XSS sanitizer using the javascript protocol and special characters

PKSA-7jd6-nb49-bz4v CVE-2024-56412 GHSA-q9jv-mm3r-j47r

Affected version: >=2.2.0,<=2.3.4|>=2.0.0,<=2.1.5|<=1.29.6|>=3.0.0,<3.7.0

Reported by:
GitHub
[MEDIUM] PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header

PKSA-nm34-xhtz-ww9p CVE-2024-56411 GHSA-hwcp-2h35-p66w

Affected version: >=2.2.0,<=2.3.4|>=2.0.0,<=2.1.5|<=1.29.6|>=3.0.0,<3.7.0

Reported by:
GitHub
[MEDIUM] PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability in custom properties

PKSA-4ckb-wpj6-c29d CVE-2024-56410 GHSA-wv23-996v-q229

Affected version: >=2.2.0,<=2.3.4|>=2.0.0,<=2.1.5|<=1.29.6|>=3.0.0,<3.7.0

Reported by:
GitHub
[HIGH] PhpSpreadsheet allows unauthorized Reflected XSS in Currency.php file

PKSA-ybqb-vyrq-8pdt CVE-2024-56409 GHSA-j2xg-cjcx-4677

Affected version: >=2.2.0,<=2.3.4|>=2.0.0,<=2.1.5|<=1.29.6|>=3.0.0,<3.7.0

Reported by:
GitHub
[HIGH] PhpSpreadsheet allows unauthorized Reflected XSS in the Accounting.php file

PKSA-285y-y5bt-kvd9 CVE-2024-56366 GHSA-c6fv-7vh8-2rhr

Affected version: >=2.2.0,<=2.3.4|>=2.0.0,<=2.1.5|<=1.29.6|>=3.0.0,<3.7.0

Reported by:
GitHub
[HIGH] PhpSpreadsheet allows unauthorized Reflected XSS in the constructor of the Downloader class

PKSA-jw5c-q9nd-tzj9 CVE-2024-56365 GHSA-jmpx-686v-c3wx

Affected version: >=2.2.0,<=2.3.4|>=2.0.0,<=2.1.5|<=1.29.6|>=3.0.0,<3.7.0

Reported by:
GitHub
[HIGH] PhpSpreadsheet allows unauthorized Reflected XSS in `Convert-Online.php` file

PKSA-bcnb-9tc9-bjb8 CVE-2024-56408 GHSA-x88g-h956-m5xg

Affected version: >=2.2.0,<=2.3.4|>=2.0.0,<=2.1.5|<=1.29.6|>=3.0.0,<3.7.0

Reported by:
GitHub
[HIGH] XXE in PHPSpreadsheet's XLSX reader

PKSA-gst3-cdk3-bpqt CVE-2024-48917 GHSA-7cc9-j4mv-vcjp

Affected version: >=3.3.0,<3.4.0|>=2.2.0,<2.3.2|>=2.0.0,<2.1.3|<1.29.4

Reported by:
GitHub
[HIGH] XmlScanner bypass leads to XXE

PKSA-dbrb-pvhs-h3st CVE-2024-47873 GHSA-jw4x-v69f-hh5w

Affected version: >=3.3.0,<3.4.0|>=2.2.0,<2.3.2|>=2.0.0,<2.1.3|<1.29.4

Reported by:
GitHub
[HIGH] XXE in PHPSpreadsheet's XLSX reader

PKSA-mkg2-1wyw-57y7 CVE-2024-45293 GHSA-6hwr-6v2f-3m88

Affected version: >=2.0.0,<2.1.1|<1.29.1|>=2.2.0,<2.3.0

Reported by:
GitHub
[MEDIUM] PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks

PKSA-p1pj-q951-6f1x CVE-2024-45292 GHSA-r8w8-74ww-j4wh

Affected version: >=2.0.0,<2.1.1|<1.29.2|>=2.2.0,<2.3.0

Reported by:
GitHub
[MEDIUM] PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled

PKSA-7f9v-sb8k-krfb CVE-2024-45291 GHSA-w9xv-qf98-ccq4

Affected version: >=2.0.0,<2.1.1|<1.29.2|>=2.2.0,<2.3.0

Reported by:
GitHub
[HIGH] PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery when opening XLSX file

PKSA-xk3k-rd1m-pxmg CVE-2024-45290 GHSA-5gpr-w2p5-6m37

Affected version: >=2.0.0,<2.1.1|<1.29.2|>=2.2.0,<2.3.0

Reported by:
GitHub
[MEDIUM] PhpSpreadsheet has an Unauthenticated Cross-Site-Scripting (XSS) in sample file

PKSA-dvbq-8ft2-ngrw CVE-2024-45060 GHSA-v66g-p9x6-v98p

Affected version: >=2.0.0,<2.1.1|<1.29.2|>=2.2.0,<2.3.0

Reported by:
GitHub
[HIGH] XXE in PHPSpreadsheet encoding is returned

PKSA-xp7t-fbrb-qjv4 CVE-2024-45048 GHSA-ghg6-32f9-2jp7

Affected version: >=2.0.0,<2.1.1|>=2.2.0,<2.2.1|<1.29.1

Reported by:
GitHub

phpoffice/phpspreadsheet Security Advisories for 2.2.0 (26)

[HIGH] PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion

[HIGH] PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion

[HIGH] PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist

[HIGH] PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions

[HIGH] PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader

[CRITICAL] PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled

[MEDIUM] PhpSpreadsheet has XSS via number format code with @ text placeholder bypasses htmlspecialchars in HTML writer

[MEDIUM] PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer

[HIGH] PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser

[MEDIUM] PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters

[MEDIUM] Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet

[MEDIUM] PhpSpreadsheet allows bypass XSS sanitizer using the javascript protocol and special characters

[MEDIUM] PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header

[MEDIUM] PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability in custom properties

[HIGH] PhpSpreadsheet allows unauthorized Reflected XSS in Currency.php file

[HIGH] PhpSpreadsheet allows unauthorized Reflected XSS in the Accounting.php file

[HIGH] PhpSpreadsheet allows unauthorized Reflected XSS in the constructor of the Downloader class

[HIGH] PhpSpreadsheet allows unauthorized Reflected XSS in `Convert-Online.php` file

[HIGH] XXE in PHPSpreadsheet's XLSX reader

[HIGH] XmlScanner bypass leads to XXE

[HIGH] XXE in PHPSpreadsheet's XLSX reader

[MEDIUM] PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks

[MEDIUM] PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled

[HIGH] PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery when opening XLSX file

[MEDIUM] PhpSpreadsheet has an Unauthenticated Cross-Site-Scripting (XSS) in sample file

[HIGH] XXE in PHPSpreadsheet encoding is returned