CVE-2026-34084
PhpSpreadsheet, a PHP library for handling spreadsheet files, has a critical flaw that lets attackers supply special file paths when loading spreadsheets. By using PHP stream wrappers such as phar://, ftp://, or ssh2.sftp://, an attacker can trigger code execution or server‑side request forgery if the application is vulnerable. The issue is fixed in newer releases of the library.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
PhpSpreadsheet library versions 1.30.2 and earlier, 2.0.0‑2.1.14, 2.2.0‑2.4.3, 3.3.0‑3.10.3, and 4.0.0‑5.5.0. Developers who use these versions in PHP applications are affected.
Real-world impact
An attacker can run arbitrary code on the server that loads spreadsheets, or force the server to make internal network requests, potentially exposing sensitive data or compromising the system.
Why this severity
The CVSS score of 9.2 reflects the combination of remote code execution and SSRF possibilities, low attack complexity, no user interaction, and no required privileges. These factors make the vulnerability highly dangerous.
What to do about it
- 011. Check the current PhpSpreadsheet version used in your application.
- 022. Upgrade PhpSpreadsheet to a fixed version: 1.30.3 or later, 2.1.15 or later, 2.4.4 or later, 3.10.4 or later, or 5.6.0 or later.
- 033. Verify that the update was applied successfully by checking the library version in your codebase.
- 044. Restart your PHP application or web server if necessary to load the updated library.
NVD-referenced vendor advisory
Timeline
- May 5, 2026 · May 5, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.
- Jul 26, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- github.com/PHPOffice/PhpSpreadsheet/se…exploitmitigationvendor advisory