CVE-2026-40902

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. In versions prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the SpreadsheetML XML reader does not validate the ss:Index row attribute against the maximum allowed row count, which can lead to CPU exhaustion and denial of service.

PhpSpreadsheet prior to version 1.30.5 contained a vulnerability that allowed bypassing stream wrapper security checks, potentially leading to remote code execution (RCE). The issue stemmed from improper URL scheme validation, enabling attackers to exploit wrappers like phar://.

PhpSpreadsheet in multiple versions (up to 1.30.2, 2.0.0-2.1.14, 2.2.0-2.4.3, 3.3.0-3.10.3, 4.0.0-5.5.0) is vulnerable to Remote Code Execution (RCE) via a user-controlled filename argument in IOFactory::load(). An attacker can supply a PHP stream wrapper path (e.g., phar://, ftp://, ssh2.sftp://) that passes the is_file() check in File::assertFile(). The phar:// wrapper triggers deserialization of PHAR metadata, potentially leading to RCE if a suitable gadget is available.

PhpSpreadsheet in multiple versions (4.0.0-5.8.0, 3.3.0-3.10.6, 2.2.0-2.4.6, 2.0.0-2.1.17, and all up to 1.30.5) contains a vulnerability in the Gnumeric reader. The reader reads attacker-supplied .gnumeric files into memory and, when the file starts with gzip magic bytes, calls gzdecode() on the full compressed contents without enforcing a decompressed-size limit. A very small compressed .gnumeric file can expand to data larger than the PHP memory limit and crash the process during Gnumeric::canRead() before the file is rejected or fully parsed. This is reachable through normal file-type detection and Gnumeric loading paths, so applications that accept attacker-controlled spreadsheet uploads can suffer denial of service.

PhpSpreadsheet in many versions is vulnerable to a DoS attack via OLE file reading. The OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles. A tiny malformed .xls file can cause the reader to repeatedly append the same sector data until PHP memory is exhausted.

PhpSpreadsheet in many versions is vulnerable to SSRF via bypass of the WEBSERVICE() domain whitelist. The webService() function validates the URL host against the whitelist, but PHP automatically follows HTTP 301/302 redirects and the redirect target is not re-validated. An attacker can upload an XLSX file that, when the WEBSERVICE() formula is calculated, causes access to arbitrary URLs, including internal addresses.

In PhpSpreadsheet versions 1.30.3 and earlier, 2.0.0-2.1.15, 2.2.0-2.4.4, 3.3.0-3.10.4, and 4.0.0-5.6.0, the HTML Writer skips htmlspecialchars() escaping when a cell uses a custom number format containing @ with literals. An attacker controlling cell content can inject HTML and JavaScript.