Executive brief
PhpSpreadsheet is a popular PHP library used for reading and writing spreadsheet files. A security flaw allows attackers to bypass existing security filters by using specially formatted file paths. On older systems (PHP 7.x), this can lead to complete server takeover (Remote Code Execution), while on newer systems (PHP 8.x), it may allow unauthorized file reading or further exploitation depending on how the library is used.
Technical details
A bypass exists in the 'File::prohibitWrappers' helper due to an architectural reliance on 'parse_url()'. When a file path is provided with three or more slashes (e.g., 'phar:///path/file.phar'), 'parse_url' returns false, causing the library to skip its stream wrapper security check. On PHP 7.x, this allows an attacker to trigger automatic phar metadata deserialization via 'is_file' or 'IOFactory::load', leading to Remote Code Execution (RCE) if suitable gadgets are present. On PHP 8.x, while automatic deserialization is disabled, the bypass still allows a phar wrapper file read primitive. The issue is fixed in version 1.30.5 by improving the wrapper detection logic.
Affected products
- PHPOffice PhpSpreadsheet < 1.30.5
Timeline
- 2026-06-07: advisory: GitHub advisory published by maintainers
- 2026-06-22: disclosed: CVE published to NVD