Phpspreadsheet

This hub aggregates every CVE we track for Phpspreadsheet, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Phpspreadsheet.

• CVE-2026-59932PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion7.5Jul 28, 2026
• CVE-2026-59933PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion7.5Jul 28, 2026
• CVE-2026-59931PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist7.7Jul 28, 2026
• CVE-2026-40863PhpSpreadsheet: CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader7.5May 12, 2026
• CVE-2026-40902PhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions7.5May 12, 2026
• CVE-2026-40296PhpSpreadsheet vulnerable to XSS in HTML writer via custom number format codes5.4May 6, 2026
• CVE-2026-35453PhpSpreadsheet XSS via number format text substitution in HTML Writer5.4May 5, 2026
• CVE-2026-34084PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load9.8May 5, 2026
• CVE-2025-54370PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser7.5Aug 25, 2025
• CVE-2025-23210Bypass XSS sanitizer using the javascript protocol and special characters in phpoffice/phpspreadsheet6.4Feb 3, 2025
• CVE-2025-22131Cross-Site Scripting (XSS) vulnerability in generateNavigation() function6.1Jan 20, 2025
• CVE-2024-56412PhpSpreadsheet vulnerable to bypass of the XSS sanitizer using the javascript protocol and special characters5.4Jan 3, 2025
• CVE-2024-56411PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header5.4Jan 3, 2025
• CVE-2024-56410PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability in custom properties5.4Jan 3, 2025
• CVE-2024-56409PhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php file5.4Jan 3, 2025