CVE-2026-108359

PhpSpreadsheet prior to version 1.30.5 contained a vulnerability that allowed bypassing stream wrapper security checks, potentially leading to remote code execution (RCE). The issue stemmed from improper URL scheme validation, enabling attackers to exploit wrappers like phar://.

PhpSpreadsheet in multiple versions (up to 1.30.2, 2.0.0-2.1.14, 2.2.0-2.4.3, 3.3.0-3.10.3, 4.0.0-5.5.0) is vulnerable to Remote Code Execution (RCE) via a user-controlled filename argument in IOFactory::load(). An attacker can supply a PHP stream wrapper path (e.g., phar://, ftp://, ssh2.sftp://) that passes the is_file() check in File::assertFile(). The phar:// wrapper triggers deserialization of PHAR metadata, potentially leading to RCE if a suitable gadget is available.

PhpSpreadsheet prior to versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0 validates only the initial external-image URL with setIsWhitelisted when setAllowExternalImages is enabled. The HTTP stream context permits PHP to follow a redirect without applying the callback to the redirected URL, so a permitted image host can redirect the server to an internal address and cause a blind GET request.

In PhpSpreadsheet before versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan uses a DOCTYPE detection pattern that accounts for NUL-byte interleaving but not ISO-2022 escape sequences in XLSX XML parts. The escape sequences prevent the scanner from matching the declaration, and XML charset normalization then removes the escape bytes before parsing, exposing a valid DOCTYPE and entity definitions.

In PhpSpreadsheet from 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored SpreadsheetML XML through XmlScanner::scan, while Xml::unentity decodes numeric entities only after each DOCTYPE pattern check. A double-encoded less-than character is reduced to a literal less-than sign, so SimpleXML receives an unchecked DOCTYPE and entity declaration.

PhpSpreadsheet in multiple versions (4.0.0-5.8.0, 3.3.0-3.10.6, 2.2.0-2.4.6, 2.0.0-2.1.17, and all up to 1.30.5) contains a vulnerability in the Gnumeric reader. The reader reads attacker-supplied .gnumeric files into memory and, when the file starts with gzip magic bytes, calls gzdecode() on the full compressed contents without enforcing a decompressed-size limit. A very small compressed .gnumeric file can expand to data larger than the PHP memory limit and crash the process during Gnumeric::canRead() before the file is rejected or fully parsed. This is reachable through normal file-type detection and Gnumeric loading paths, so applications that accept attacker-controlled spreadsheet uploads can suffer denial of service.

PhpSpreadsheet in many versions is vulnerable to a DoS attack via OLE file reading. The OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles. A tiny malformed .xls file can cause the reader to repeatedly append the same sector data until PHP memory is exhausted.

PhpSpreadsheet in many versions is vulnerable to SSRF via bypass of the WEBSERVICE() domain whitelist. The webService() function validates the URL host against the whitelist, but PHP automatically follows HTTP 301/302 redirects and the redirect target is not re-validated. An attacker can upload an XLSX file that, when the WEBSERVICE() formula is calculated, causes access to arbitrary URLs, including internal addresses.

In the PhpSpreadsheet library prior to versions 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, there is a vulnerability in the ColumnAndRowAttributes::readRowAttributes() method that does not validate row numbers in XLSX files against the maximum row limit. An attacker can craft an XLSX file that causes excessive CPU load during row iteration.

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. In versions prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the SpreadsheetML XML reader does not validate the ss:Index row attribute against the maximum allowed row count, which can lead to CPU exhaustion and denial of service.