PHPOffice / PhpSpreadsheet
28 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-59932 | PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion | HIGH | 7.5 | Jul 28, 2026 |
| CVE-2026-59933 | PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion | HIGH | 7.5 | Jul 28, 2026 |
| CVE-2026-59931 | PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist | HIGH | 7.7 | Jul 28, 2026 |
| CVE-2026-45034 | PhpSpreadsheet: File::prohibitWrappers bypass | CRITICAL | 9.2 | Jun 22, 2026 |
| CVE-2026-40863 | PhpSpreadsheet: CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader | HIGH | 7.5 | May 12, 2026 |
| CVE-2026-40902 | PhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions | HIGH | 7.5 | May 12, 2026 |
| CVE-2026-40296 | PhpSpreadsheet vulnerable to XSS in HTML writer via custom number format codes | MEDIUM | 5.4 | May 6, 2026 |
| CVE-2026-35453 | PhpSpreadsheet XSS via number format text substitution in HTML Writer | MEDIUM | 5.3 | May 5, 2026 |
| CVE-2026-34084 | PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load | CRITICAL | 9.2 | May 5, 2026 |
| CVE-2025-54370 | PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser | HIGH | 8.7 | Aug 25, 2025 |
| CVE-2025-23210 | Bypass XSS sanitizer using the javascript protocol and special characters in phpoffice/phpspreadsheet | MEDIUM | 4.8 | Feb 3, 2025 |
| CVE-2025-22131 | Cross-Site Scripting (XSS) vulnerability in generateNavigation() function | MEDIUM | 5.1 | Jan 20, 2025 |
| CVE-2024-56412 | PhpSpreadsheet vulnerable to bypass of the XSS sanitizer using the javascript protocol and special characters | MEDIUM | 4.8 | Jan 3, 2025 |
| CVE-2024-56411 | PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header | MEDIUM | 4.8 | Jan 3, 2025 |
| CVE-2024-56410 | PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability in custom properties | MEDIUM | 4.8 | Jan 3, 2025 |
| CVE-2024-56409 | PhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php file | HIGH | 8.3 | Jan 3, 2025 |
| CVE-2024-56366 | PhpSpreadsheet vulnerable to unauthorized reflected XSS in the Accounting.php file | HIGH | 8.3 | Jan 3, 2025 |
| CVE-2024-56365 | PhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader class | HIGH | 8.3 | Jan 3, 2025 |
| CVE-2024-56408 | PhpSpreadsheet allows unauthorized reflected XSS in `Convert-Online.php` file | HIGH | 8.3 | Jan 3, 2025 |
| CVE-2024-48917 | XXE in PHPSpreadsheet's XLSX reader | HIGH | 7.5 | Nov 18, 2024 |
| CVE-2024-47873 | PhpSpreadsheet XmlScanner bypass leads to XXE | HIGH | 7.5 | Nov 18, 2024 |
| CVE-2024-45060 | Unauthenticated Cross-Site-Scripting (XSS) in sample file in PHPSpreadsheet | MEDIUM | 5.3 | Oct 7, 2024 |
| CVE-2024-45290 | Path traversal and Server-Side Request Forgery when opening XLSX files in PHPSpreadsheet | HIGH | 8.3 | Oct 7, 2024 |
| CVE-2024-45291 | Path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled in PHPSpreadsheet | MEDIUM | 6.0 | Oct 7, 2024 |
| CVE-2024-45292 | PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks | MEDIUM | 4.8 | Oct 7, 2024 |
Showing 1 to 25 of 28 CVEs