CVE Tools
Track your stack

Phpspreadsheet

35 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Phpspreadsheet, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Phpspreadsheet CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Phpspreadsheet CVEs per month
MonthCVEs
2024-112
2024-120
2025-018
2025-021
2025-030
2025-040
2025-050
2025-060
2025-070
2025-081
2025-090
2025-100
2025-110
2025-120
2026-010
2026-020
2026-030
2026-040
2026-055
2026-061
2026-073
2026-080
2026-090
2026-104

Severity

How the 35 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical13%
  • High1548%
  • Medium1548%

Latest CVEs

The 15 most recently published vulnerabilities affecting Phpspreadsheet.

  1. CVE-2026-108357PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service—
  2. CVE-2026-108359PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)—
  3. CVE-2026-108358PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service—
  4. CVE-2026-108360PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading6.4
  5. CVE-2026-59932PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion7.5
  6. CVE-2026-59933PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion7.5
  7. CVE-2026-59931PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist7.7
  8. CVE-2026-45034PhpSpreadsheet: File::prohibitWrappers bypass—
  9. CVE-2026-40863PhpSpreadsheet: CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader7.5
  10. CVE-2026-40902PhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions7.5
  11. CVE-2026-40296PhpSpreadsheet vulnerable to XSS in HTML writer via custom number format codes5.4
  12. CVE-2026-35453PhpSpreadsheet XSS via number format text substitution in HTML Writer5.4
  13. CVE-2026-34084PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load9.8
  14. CVE-2025-54370PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser7.5
  15. CVE-2025-23210Bypass XSS sanitizer using the javascript protocol and special characters in phpoffice/phpspreadsheet6.4

Product grouping is registry-driven, with AI assist and human review. How it works