Composer phpoffice/phpspreadsheet has 35 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2018-19277 | XXE in PHPSpreadsheet due to encoding issue | high | 8.8 | <1.5.1 | 1.5.1 |
| CVE-2024-45293 | XXE in PHPSpreadsheet's XLSX reader | high | 7.5 | >=2.2.0 and <2.3.0 or <1.29.1 or >=2.0.0 and <2.1.1 | 2.3.0, 1.29.1, 2.1.1 |
| CVE-2019-12331 | XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue | high | 8.8 | <1.8.0 | 1.8.0 |
| CVE-2020-7776 | Cross-site scripting in phpoffice/phpspreadsheet | medium | 6.4 | <1.16.0 | 1.16.0 |
| CVE-2024-45291 | PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled | medium | 6.3 | >=2.2.0 and <2.3.0 or <1.29.2 or >=2.0.0 and <2.1.1 | 2.3.0, 1.29.2, 2.1.1 |
| CVE-2025-54370 | PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser | high | 0.0 | <1.30.0 or >=2.0.0 and <2.1.12 or >=2.2.0 and <2.4.0 or >=3.0.0 and <3.10.0 or >=4.0.0 and <5.0.0 or >=2.0.0 and <2.1.0 or >=2.1.0 and <2.1.12 or >=2.2.0 and <2.3.0 or >=2.3.0 and <2.4.0 | 1.30.0, 2.1.12, 2.4.0, 3.10.0 |
| CVE-2024-47873 | XmlScanner bypass leads to XXE | high | 7.5 | <1.29.4 or >=2.0.0 and <2.1.3 or >=2.2.0 and <2.3.2 or >=3.3.0 and <3.4.0 | 1.29.4, 2.1.3, 2.3.2, 3.4.0 |
| CVE-2024-48917 | XXE in PHPSpreadsheet's XLSX reader | high | 7.5 | <1.29.4 or >=2.0.0 and <2.1.3 or >=2.2.0 and <2.3.2 or >=3.3.0 and <3.4.0 | 1.29.4, 2.1.3, 2.3.2, 3.4.0 |
| CVE-2026-34084 | PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled | critical | 0.0 | >=4.0.0 and <5.6.0 or >=3.3.0 and <3.10.4 or >=2.2.0 and <2.4.4 or >=2.0.0 and <2.1.15 or <1.30.3 | 5.6.0, 3.10.4, 2.4.4, 2.1.15 |
| CVE-2024-45290 | PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery when opening XLSX file | high | 7.7 | >=2.2.0 and <2.3.0 or <1.29.2 or >=2.0.0 and <2.1.1 | 2.3.0, 1.29.2, 2.1.1 |
| CVE-2024-45048 | XXE in PHPSpreadsheet encoding is returned | high | 8.8 | <1.29.1 or >=2.2.0 and <2.2.1 or >=2.0.0 and <2.1.1 | 1.29.1, 2.2.1, 2.1.1 |
| CVE-2024-45060 | PhpSpreadsheet has an Unauthenticated Cross-Site-Scripting (XSS) in sample file | medium | 6.1 | >=2.2.0 and <2.3.0 or <1.29.2 or >=2.0.0 and <2.1.1 | 2.3.0, 1.29.2, 2.1.1 |
| CVE-2026-108358 | PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service | high | 0.0 | >=4.0.0 and <5.10.0 or >=3.3.0 and <3.10.8 or >=2.2.0 and <2.4.8 or >=2.0.0 and <2.1.19 or <1.30.7 | 5.10.0, 3.10.8, 2.4.8, 2.1.19 |
| CVE-2026-59931 | PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist | high | 7.7 | >=4.0.0 and <5.8.1 or >=3.3.0 and <3.10.7 or >=2.2.0 and <2.4.7 or >=2.0.0 and <2.1.18 or <1.30.6 | 5.8.1, 3.10.7, 2.4.7, 2.1.18 |
| CVE-2026-45034 | PHPSpreadsheet has a patch bypass for CVE-2026-34084 | critical | 0.0 | <1.30.5 | 1.30.5 |
| CVE-2026-59932 | PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion | high | 7.5 | >=4.0.0 and <5.8.1 or >=3.3.0 and <3.10.7 or >=2.2.0 and <2.4.7 or >=2.0.0 and <2.1.18 or <1.30.6 | 5.8.1, 3.10.7, 2.4.7, 2.1.18 |
| CVE-2026-59933 | PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion | high | 7.5 | >=4.0.0 and <5.8.1 or >=3.3.0 and <3.10.7 or >=2.2.0 and <2.4.7 or >=2.0.0 and <2.1.18 or <1.30.6 | 5.8.1, 3.10.7, 2.4.7, 2.1.18 |
| CVE-2024-45046 | PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information | medium | 5.4 | >=2.0.0 and <2.1.0 or <1.29.1 | 2.1.0, 1.29.1 |
| CVE-2025-23210 | PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters | medium | 5.4 | >=3.0.0 and <3.9.0 or <1.29.9 or >=2.2.0 and <2.3.7 or >=2.0.0 and <2.1.8 | 3.9.0, 1.29.9, 2.3.7, 2.1.8 |
| CVE-2024-56408 | PhpSpreadsheet allows unauthorized Reflected XSS in `Convert-Online.php` file | high | 7.1 | >=3.0.0 and <3.7.0 or <1.29.7 or >=2.0.0 and <2.1.6 or >=2.2.0 and <2.3.5 | 3.7.0, 1.29.7, 2.1.6, 2.3.5 |
| CVE-2026-108359 | PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS) | high | 0.0 | >=4.0.0 and <5.10.0 or >=3.3.0 and <3.10.8 or >=2.2.0 and <2.4.8 or >=2.0.0 and <2.1.19 or <1.30.7 | 5.10.0, 3.10.8, 2.4.8, 2.1.19 |
| CVE-2026-40863 | PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader | high | 7.5 | >=4.0.0 and <5.7.0 or >=3.3.0 and <3.10.5 or >=2.2.0 and <2.4.5 or >=2.0.0 and <2.1.16 or <1.30.6 | 5.7.0, 3.10.5, 2.4.5, 2.1.16 |
| CVE-2026-40902 | PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions | high | 7.5 | >=4.0.0 and <5.7.0 or >=3.3.0 and <3.10.5 or >=2.2.0 and <2.4.5 or >=2.0.0 and <2.1.16 or <1.30.4 | 5.7.0, 3.10.5, 2.4.5, 2.1.16 |
| CVE-2025-22131 | Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet | medium | 6.1 | >=3.0.0 and <3.8.0 or <1.29.8 or >=2.0.0 and <2.1.7 or >=2.2.0 and <2.3.6 | 3.8.0, 1.29.8, 2.1.7, 2.3.6 |
| CVE-2024-56412 | PhpSpreadsheet allows bypass XSS sanitizer using the javascript protocol and special characters | medium | 5.4 | >=3.0.0 and <3.7.0 or <1.29.7 or >=2.0.0 and <2.1.6 or >=2.2.0 and <2.3.5 | 3.7.0, 1.29.7, 2.1.6, 2.3.5 |
| CVE-2024-56411 | PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header | medium | 5.4 | >=3.0.0 and <3.7.0 or <1.29.7 or >=2.0.0 and <2.1.6 or >=2.2.0 and <2.3.5 | 3.7.0, 1.29.7, 2.1.6, 2.3.5 |
| CVE-2026-108357 | PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service | high | 0.0 | >=4.0.0 and <5.10.0 or >=3.3.0 and <3.10.8 | 5.10.0, 3.10.8 |
| CVE-2024-45292 | PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks | medium | 5.4 | >=2.2.0 and <2.3.0 or <1.29.2 or >=2.0.0 and <2.1.1 | 2.3.0, 1.29.2, 2.1.1 |
| CVE-2024-56366 | PhpSpreadsheet allows unauthorized Reflected XSS in the Accounting.php file | high | 7.1 | >=3.0.0 and <3.7.0 or <1.29.7 or >=2.0.0 and <2.1.6 or >=2.2.0 and <2.3.5 | 3.7.0, 1.29.7, 2.1.6, 2.3.5 |
| CVE-2024-56409 | PhpSpreadsheet allows unauthorized Reflected XSS in Currency.php file | high | 7.1 | >=3.0.0 and <3.7.0 or <1.29.7 or >=2.0.0 and <2.1.6 or >=2.2.0 and <2.3.5 | 3.7.0, 1.29.7, 2.1.6, 2.3.5 |
| CVE-2024-56410 | PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability in custom properties | medium | 5.4 | >=3.0.0 and <3.7.0 or <1.29.7 or >=2.0.0 and <2.1.6 or >=2.2.0 and <2.3.5 | 3.7.0, 1.29.7, 2.1.6, 2.3.5 |
| CVE-2024-56365 | PhpSpreadsheet allows unauthorized Reflected XSS in the constructor of the Downloader class | high | 7.1 | >=3.0.0 and <3.7.0 or <1.29.7 or >=2.0.0 and <2.1.6 or >=2.2.0 and <2.3.5 | 3.7.0, 1.29.7, 2.1.6, 2.3.5 |
| CVE-2026-40296 | PhpSpreadsheet has XSS via number format code with @ text placeholder bypasses htmlspecialchars in HTML writer | medium | 5.4 | >=4.0.0 and <5.7.0 or >=3.3.0 and <3.10.5 or >=2.2.0 and <2.4.5 or >=2.0.0 and <2.1.16 or <1.30.4 | 5.7.0, 3.10.5, 2.4.5, 2.1.16 |
| CVE-2026-108360 | PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading | medium | 6.4 | >=4.0.0 and <5.10.0 or >=3.3.0 and <3.10.8 or >=2.2.0 and <2.4.8 or >=2.0.0 and <2.1.19 or <1.30.7 | 5.10.0, 3.10.8, 2.4.8, 2.1.19 |
| CVE-2026-35453 | PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer | medium | 0.0 | >=4.0.0 and <5.7.0 or >=3.3.0 and <3.10.5 or >=2.2.0 and <2.4.5 or >=2.0.0 and <2.1.16 or <1.30.4 | 5.7.0, 3.10.5, 2.4.5, 2.1.16 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# PHP projects (recommended) composer require --dev phpwarden/phpwarden # then vendor/bin/phpwarden deps composer.lock # or, without Composer pipx install phpwarden && phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked