Login Request a demo
PH
Product
PhpSpreadsheet
by PHPOffice · last CVE Oct 22, 2026
33
CVEs
0
On KEV
9.8
Max CVSS
4
New 30D
Vulnerabilities33In the news0Timeline
Severity mix
Critical 2High 15Medium 16Low 0
Severity
All severities33Critical2High15Medium16Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add PhpSpreadsheet to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-108357
New
8.8
0%
Oct 22
PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service
Affected: >= 3.3.0, < 3.10.8; >= 4.0.0, < 5.10.0
CVE-2026-108358
New
8.8
0%
Oct 22
PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service
Affected: < 1.30.7; >= 2.0.0, < 2.1.19; >= 2.2.0, < 2.4.8; >= 3.3.0, < 3.10.8; >= 4.0.0, < 5.10.0
CVE-2024-45291
8.8
1%
Oct 7
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files
Affected: before 1.29.2; 2.0.0 before 2.1.1; 2.2.0 before 2.3.0
CVE-2019-12331
8.8
1%
Nov 7
PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue
Affected: before 1.8.0
CVE-2018-19277
8.8
8%
Nov 14
securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file
Affected: through 1.5.0
CVE-2026-108359
New
8.7
0%
Oct 22
PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)
Affected: < 1.30.7; >= 2.0.0, < 2.1.19; >= 2.2.0, < 2.4.8; >= 3.3.0, < 3.10.8; >= 4.0.0, < 5.10.0
CVE-2026-59931
7.7
0%
Jul 28
PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
Affected: >= 4.0.0, < 5.8.1; >= 3.3.0, < 3.10.7; >= 2.2.0, < 2.4.7; >= 2.0.0, < 2.1.18; < 1.30.6
CVE-2026-59932
7.5
0%
Jul 28
PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
Affected: >= 4.0.0, < 5.8.1; >= 3.3.0, < 3.10.7; >= 2.2.0, < 2.4.7; >= 2.0.0, < 2.1.18; < 1.30.6
CVE-2026-59933
7.5
0%
Jul 28
PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
Affected: >= 4.0.0, < 5.8.1; >= 3.3.0, < 3.10.7; >= 2.2.0, < 2.4.7; >= 2.0.0, < 2.1.18; < 1.30.6
CVE-2026-40863
7.5
0%
May 12
PhpSpreadsheet: CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader
Affected: < 1.30.4; >= 2.0.0, < 2.1.16; >= 2.2.0, < 2.4.5; >= 3.3.0, < 3.10.5; >= 4.0.0, < 5.7.0
CVE-2026-40902
7.5
0%
May 12
PhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions
Affected: < 1.30.4; >= 2.0.0, < 2.1.16; >= 2.2.0, < 2.4.5; >= 3.3.0, < 3.10.5; >= 4.0.0, < 5.7.0
CVE-2024-48917
7.5
1%
Nov 18
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files
Affected: before 1.29.4; 2.0.0 before 2.1.3; 2.2.0 before 2.3.2; 3.3.0 before 3.4.0
CVE-2024-47873
7.5
1%
Nov 18
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files
Affected: before 1.29.4; 2.0.0 before 2.1.3; 2.2.0 before 2.3.2; 3.3.0 before 3.4.0
CVE-2024-45290
7.5
1%
Oct 7
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files
Affected: before 1.29.2; 2.0.0 before 2.1.1; 2.2.0 before 2.3.0
CVE-2024-45293
7.5
3%
Oct 7
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files
Affected: before 1.29.1; 2.0.0 before 2.1.1; 2.2.0 before 2.3.0
Showing 15