CVE-2026-45034: PHPOffice PhpSpreadsheet security bypass in File::prohibitWrappers

CVE-2026-45034 · Severity: critical · CVSS 4 · Published 2026-06-22

PhpSpreadsheet is a popular PHP library used for reading and writing spreadsheet files. A security flaw allows attackers to bypass existing security filters by using specially formatted file paths. On older systems (PHP 7.x), this can lead to complete server takeover (Remote Code Execution), while on newer systems (PHP 8.x), it may allow unauthorized file reading or further exploitation depending on how the library is used.

Technologies: phpoffice/phpspreadsheet (Packagist), Phpoffice Phpspreadsheet. Vendors: Packagist, Phpoffice.

Quick answers

Is CVE-2026-45034 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45034 being exploited in the wild.
How severe is CVE-2026-45034?
Critical severity, with a CVSS score of 4, published 22 June 2026.
Which products and versions are affected?
phpoffice/phpspreadsheet (Packagist) <= 1.30.4, ECOSYSTEM:introduced=0,fixed=1.30.5; Phpoffice Phpspreadsheet < 1.30.5, <= 1.30.4.
Is there a fix for CVE-2026-45034?
Yes. phpoffice/phpspreadsheet (Packagist): upgrade to 1.30.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45034 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-45034?
Check whether you run phpoffice/phpspreadsheet (Packagist) or Phpoffice Phpspreadsheet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • phpoffice/phpspreadsheet (Packagist): upgrade to 1.30.5 or later
    composer require phpoffice/phpspreadsheet:^1.30.5

Technical details

A bypass exists in the 'File::prohibitWrappers' helper due to an architectural reliance on 'parse_url()'. When a file path is provided with three or more slashes (e.g., 'phar:///path/file.phar'), 'parse_url' returns false, causing the library to skip its stream wrapper security check. On PHP 7.x, this allows an attacker to trigger automatic phar metadata deserialization via 'is_file' or 'IOFactory::load', leading to Remote Code Execution (RCE) if suitable gadgets are present. On PHP 8.x, while automatic deserialization is disabled, the bypass still allows a phar wrapper file read primitive. The issue is fixed in version 1.30.5 by improving the wrapper detection logic.

Affected products

  • PHPOffice PhpSpreadsheet < 1.30.5

Identifiers

  • CVE-2026-45034
  • GHSA-87m4-826x-3crx

Timeline

  • 2026-06-07: advisory: GitHub advisory published by maintainers
  • 2026-06-22: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.