Executive brief
PhpSpreadsheet, a popular PHP library for handling Excel and XML spreadsheet files, is vulnerable to a denial-of-service attack. An attacker can provide a specially crafted, very small XML file that forces the server to attempt to process billions of empty rows. This results in extreme CPU exhaustion, potentially crashing the web server or making the application unavailable to all users.
Technical details
The SpreadsheetML XML reader (Reader\Xml) in PhpSpreadsheet fails to validate the 'ss:Index' row attribute against the library's maximum allowed row count (AddressRange::MAX_ROW). By providing a value such as '999999999', an attacker can inflate the internal 'cachedHighestRow' property to approximately one billion. Subsequent calls to 'getRowIterator()' without an explicit end row will attempt to iterate through the entire range, leading to 100% CPU utilization and a denial-of-service condition. The vulnerability can be triggered with a small (~300 byte) XML file and requires no authentication. Patches are available in versions 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0.
Affected products
- PHPOffice PhpSpreadsheet < 1.30.4, >= 2.0.0 < 2.1.16, >= 2.2.0 < 2.4.5, >= 3.3.0 < 3.10.5, >= 4.0.0 < 5.7.0
Timeline
- 2026-04-28: advisory: GitHub advisory published by maintainers
- 2026-05-12: disclosed: CVE published to NVD