CVE-2026-59932
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
PhpSpreadsheet in multiple versions (4.0.0-5.8.0, 3.3.0-3.10.6, 2.2.0-2.4.6, 2.0.0-2.1.17, and all up to 1.30.5) contains a vulnerability in the Gnumeric reader. The reader reads attacker-supplied .gnumeric files into memory and, when the file starts with gzip magic bytes, calls gzdecode() on the full compressed contents without enforcing a decompressed-size limit. A very small compressed .gnumeric file can expand to data larger than the PHP memory limit and crash the process during Gnumeric::canRead() before the file is rejected or fully parsed. This is reachable through normal file-type detection and Gnumeric loading paths, so applications that accept attacker-controlled spreadsheet uploads can suffer denial of service.
Risk Assessment
The organization is at risk of DoS attacks that can crash the PHP process and disrupt applications processing uploaded spreadsheets.
Recommendation
Upgrade PhpSpreadsheet to version 5.8.1, 3.10.7, 2.4.7, 2.1.18, or 1.30.6, depending on the branch in use.
Other vulnerabilities in PhpSpreadsheet
See all- CVE-2026-40902High
In the PhpSpreadsheet library prior to versions 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, there is a vulnerability in the ColumnAndRowAttributes::readRowAttributes() method that does not validate row numbers in XLSX files against the maximum row limit. An attacker can craft an XLSX file that causes excessive CPU load during row iteration.
- CVE-2026-40863High
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. In versions prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the SpreadsheetML XML reader does not validate the ss:Index row attribute against the maximum allowed row count, which can lead to CPU exhaustion and denial of service.
- CVE-2026-45034Critical
PhpSpreadsheet prior to version 1.30.5 contained a vulnerability that allowed bypassing stream wrapper security checks, potentially leading to remote code execution (RCE). The issue stemmed from improper URL scheme validation, enabling attackers to exploit wrappers like phar://.
- CVE-2026-34084Critical
PhpSpreadsheet in multiple versions (up to 1.30.2, 2.0.0-2.1.14, 2.2.0-2.4.3, 3.3.0-3.10.3, 4.0.0-5.5.0) is vulnerable to Remote Code Execution (RCE) via a user-controlled filename argument in IOFactory::load(). An attacker can supply a PHP stream wrapper path (e.g., phar://, ftp://, ssh2.sftp://) that passes the is_file() check in File::assertFile(). The phar:// wrapper triggers deserialization of PHAR metadata, potentially leading to RCE if a suitable gadget is available.
- CVE-2026-59933High
PhpSpreadsheet in many versions is vulnerable to a DoS attack via OLE file reading. The OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles. A tiny malformed .xls file can cause the reader to repeatedly append the same sector data until PHP memory is exhausted.
- CVE-2026-59931High
PhpSpreadsheet in many versions is vulnerable to SSRF via bypass of the WEBSERVICE() domain whitelist. The webService() function validates the URL host against the whitelist, but PHP automatically follows HTTP 301/302 redirects and the redirect target is not re-validated. An attacker can upload an XLSX file that, when the WEBSERVICE() formula is calculated, causes access to arbitrary URLs, including internal addresses.
- CVE-2026-35453Medium
In PhpSpreadsheet versions 1.30.3 and earlier, 2.0.0-2.1.15, 2.2.0-2.4.4, 3.3.0-3.10.4, and 4.0.0-5.6.0, the HTML Writer skips htmlspecialchars() escaping when a cell uses a custom number format containing @ with literals. An attacker controlling cell content can inject HTML and JavaScript.
Original NVD description (English source)
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the Gnumeric reader reads attacker-supplied .gnumeric files into memory and, when the file starts with gzip magic bytes, calls gzdecode() on the full compressed contents without enforcing a decompressed-size limit. A very small compressed .gnumeric file can expand to data larger than the PHP memory limit and crash the process during Gnumeric::canRead() before the file is rejected or fully parsed. This is reachable through normal file-type detection and Gnumeric loading paths, so applications that accept attacker-controlled spreadsheet uploads can suffer denial of service. This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18 and 1.30.6.