# phpoffice/phpspreadsheet (Packagist) vulnerabilities Source: https://junglewise.ai/threats/technologies/phpoffice-phpspreadsheet Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 10 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/phpoffice-phpspreadsheet.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 35 vulnerabilities in phpoffice/phpspreadsheet (Packagist): 0 in the last 7 days and 4 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-108360, was published on 22 October 2026. 4 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 4 - Last 90 days: 4 - All time: 35 (2 critical, 0 exploited in the wild) ## About phpoffice/phpspreadsheet (Packagist) PHP library for reading and writing spreadsheet files in various formats including Excel. ## Latest phpoffice/phpspreadsheet (Packagist) vulnerabilities - [CVE-2026-108360: PHPOffice PhpSpreadsheet redirect validation bypass in external image loading](https://junglewise.ai/threats/cve-2026-108360-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing) (medium, CVSS 6.4, published 22 Oct 2026) - [CVE-2026-108359: PhpSpreadsheet denial-of-service via unbounded row repetition](https://junglewise.ai/threats/cve-2026-108359-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing) (high, CVSS 4, published 22 Oct 2026) - [CVE-2026-108358: PhpSpreadsheet XmlScanner XML entity expansion denial of service](https://junglewise.ai/threats/cve-2026-108358-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing) (high, CVSS 4, published 22 Oct 2026) - [CVE-2026-108357: PHPOffice PhpSpreadsheet XML entity expansion denial of service](https://junglewise.ai/threats/cve-2026-108357-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing) (high, CVSS 4, published 22 Oct 2026) - [CVE-2026-59932: PHPOffice PhpSpreadsheet denial of service via Gnumeric gzip expansion](https://junglewise.ai/threats/cve-2026-59932-phpoffice-phpspreadsheet-denial-of-service-via-gnumeric-gzip) (high, CVSS 7.5, published 28 Jul 2026) - [CVE-2026-59933: PHPOffice PhpSpreadsheet denial of service in OLE reader](https://junglewise.ai/threats/cve-2026-59933-phpoffice-phpspreadsheet-denial-of-service-in-ole-reader) (high, CVSS 7.5, published 28 Jul 2026) - [CVE-2026-59931: PHPOffice PhpSpreadsheet SSRF bypass in WEBSERVICE domain whitelist](https://junglewise.ai/threats/cve-2026-59931-phpoffice-phpspreadsheet-ssrf-bypass-in-webservice-domain) (high, CVSS 7.7, published 28 Jul 2026) - [CVE-2026-45034: PHPOffice PhpSpreadsheet security bypass in File::prohibitWrappers](https://junglewise.ai/threats/cve-2026-45034-phpoffice-phpspreadsheet-security-bypass-in-file-prohibitwrappers) (critical, CVSS 4, published 22 Jun 2026) - [CVE-2026-40902: PHPOffice PhpSpreadsheet CPU denial of service in XLSX reader](https://junglewise.ai/threats/cve-2026-40902-phpoffice-phpspreadsheet-cpu-denial-of-service-in-xlsx-reader) (high, CVSS 7.5, published 12 May 2026) - [CVE-2026-40863: PHPOffice PhpSpreadsheet denial of service in SpreadsheetML XML reader](https://junglewise.ai/threats/cve-2026-40863-phpspreadsheet-has-cpu-denial-of-service-via-unbounded-row-index) (high, CVSS 7.5, published 12 May 2026) - [CVE-2026-40296: PHPOffice PhpSpreadsheet XSS in HTML writer via number format bypass](https://junglewise.ai/threats/cve-2026-40296-phpoffice-phpspreadsheet-xss-in-html-writer-via-number-format) (medium, CVSS 5.4, published 6 May 2026) - [CVE-2026-35453: PHPOffice PhpSpreadsheet XSS in HTML Writer via NumberFormat](https://junglewise.ai/threats/cve-2026-35453-phpoffice-phpspreadsheet-xss-in-html-writer-via-numberformat) (medium, CVSS 5.4, published 5 May 2026) - [CVE-2026-34084: PHPOffice PhpSpreadsheet RCE and SSRF via PHP Stream Wrappers](https://junglewise.ai/threats/cve-2026-34084-phpoffice-phpspreadsheet-rce-and-ssrf-via-php-stream-wrappers) (critical, CVSS 9.8, published 5 May 2026) - [CVE-2025-54370: PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser](https://junglewise.ai/threats/cve-2025-54370-phpspreadsheet-vulnerable-to-ssrf-when-reading-and-displaying-a) (medium, CVSS 4, published 25 Aug 2025) - [CVE-2025-23210: PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters](https://junglewise.ai/threats/cve-2025-23210-phpspreadsheet-allows-bypassing-of-xss-sanitizer-using-the) (low, CVSS 3.1, published 3 Feb 2025) - [CVE-2025-22131: Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet](https://junglewise.ai/threats/cve-2025-22131-cross-site-scripting-xss-vulnerability-in-generatenavigation) (low, CVSS 3.1, published 21 Jan 2025) - [CVE-2024-56412: PhpSpreadsheet allows bypass XSS sanitizer using the javascript protocol and special characters](https://junglewise.ai/threats/cve-2024-56412-phpspreadsheet-allows-bypass-xss-sanitizer-using-the-javascript) (low, CVSS 3.1, published 3 Jan 2025) - [CVE-2024-56411: PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header](https://junglewise.ai/threats/cve-2024-56411-phpspreadsheet-has-a-cross-site-scripting-xss-vulnerability-of) (low, CVSS 3.1, published 3 Jan 2025) - [CVE-2024-56410: PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability in custom properties](https://junglewise.ai/threats/cve-2024-56410-phpspreadsheet-has-a-cross-site-scripting-xss-vulnerability-in) (low, CVSS 3.1, published 3 Jan 2025) - [CVE-2024-56409: PhpSpreadsheet allows unauthorized Reflected XSS in Currency.php file](https://junglewise.ai/threats/cve-2024-56409-phpspreadsheet-allows-unauthorized-reflected-xss-in-currency-php) (low, CVSS 3.1, published 3 Jan 2025) - [CVE-2024-56366: PhpSpreadsheet allows unauthorized Reflected XSS in the Accounting.php file](https://junglewise.ai/threats/cve-2024-56366-phpspreadsheet-allows-unauthorized-reflected-xss-in-the) (low, CVSS 3.1, published 3 Jan 2025) - [CVE-2024-56365: PhpSpreadsheet allows unauthorized Reflected XSS in the constructor of the Downloader class](https://junglewise.ai/threats/cve-2024-56365-phpspreadsheet-allows-unauthorized-reflected-xss-in-the) (low, CVSS 3.1, published 3 Jan 2025) - [CVE-2024-56408: PhpSpreadsheet allows unauthorized Reflected XSS in `Convert-Online.php` file](https://junglewise.ai/threats/cve-2024-56408-phpspreadsheet-allows-unauthorized-reflected-xss-in-convert) (low, CVSS 3.1, published 3 Jan 2025) - [CVE-2024-48917: XXE in PHPSpreadsheet's XLSX reader](https://junglewise.ai/threats/cve-2024-48917-xxe-in-phpspreadsheet-s-xlsx-reader) (low, CVSS 3.1, published 18 Nov 2024) - [CVE-2024-47873: XmlScanner bypass leads to XXE](https://junglewise.ai/threats/cve-2024-47873-xmlscanner-bypass-leads-to-xxe) (low, CVSS 3.1, published 18 Nov 2024) ## Most severe phpoffice/phpspreadsheet (Packagist) vulnerabilities - [CVE-2026-34084: PHPOffice PhpSpreadsheet RCE and SSRF via PHP Stream Wrappers](https://junglewise.ai/threats/cve-2026-34084-phpoffice-phpspreadsheet-rce-and-ssrf-via-php-stream-wrappers) (critical, CVSS 9.8, published 5 May 2026) - [CVE-2026-45034: PHPOffice PhpSpreadsheet security bypass in File::prohibitWrappers](https://junglewise.ai/threats/cve-2026-45034-phpoffice-phpspreadsheet-security-bypass-in-file-prohibitwrappers) (critical, CVSS 4, published 22 Jun 2026) - [CVE-2026-59931: PHPOffice PhpSpreadsheet SSRF bypass in WEBSERVICE domain whitelist](https://junglewise.ai/threats/cve-2026-59931-phpoffice-phpspreadsheet-ssrf-bypass-in-webservice-domain) (high, CVSS 7.7, published 28 Jul 2026) - [CVE-2026-59932: PHPOffice PhpSpreadsheet denial of service via Gnumeric gzip expansion](https://junglewise.ai/threats/cve-2026-59932-phpoffice-phpspreadsheet-denial-of-service-via-gnumeric-gzip) (high, CVSS 7.5, published 28 Jul 2026) - [CVE-2026-59933: PHPOffice PhpSpreadsheet denial of service in OLE reader](https://junglewise.ai/threats/cve-2026-59933-phpoffice-phpspreadsheet-denial-of-service-in-ole-reader) (high, CVSS 7.5, published 28 Jul 2026) - [CVE-2026-40902: PHPOffice PhpSpreadsheet CPU denial of service in XLSX reader](https://junglewise.ai/threats/cve-2026-40902-phpoffice-phpspreadsheet-cpu-denial-of-service-in-xlsx-reader) (high, CVSS 7.5, published 12 May 2026) - [CVE-2026-40863: PHPOffice PhpSpreadsheet denial of service in SpreadsheetML XML reader](https://junglewise.ai/threats/cve-2026-40863-phpspreadsheet-has-cpu-denial-of-service-via-unbounded-row-index) (high, CVSS 7.5, published 12 May 2026) - [CVE-2026-108358: PhpSpreadsheet XmlScanner XML entity expansion denial of service](https://junglewise.ai/threats/cve-2026-108358-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing) (high, CVSS 4, published 22 Oct 2026) - [CVE-2026-108359: PhpSpreadsheet denial-of-service via unbounded row repetition](https://junglewise.ai/threats/cve-2026-108359-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing) (high, CVSS 4, published 22 Oct 2026) - [CVE-2026-108357: PHPOffice PhpSpreadsheet XML entity expansion denial of service](https://junglewise.ai/threats/cve-2026-108357-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing) (high, CVSS 4, published 22 Oct 2026) ## Vulnerabilities per week 4 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 4 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Packagist technologies - [moodle/moodle (Packagist)](https://junglewise.ai/threats/technologies/moodle-moodle): 434 vulnerabilities - [magento/community-edition (Packagist)](https://junglewise.ai/threats/technologies/packagist-magento-community-edition): 362 vulnerabilities - [typo3/cms (Packagist)](https://junglewise.ai/threats/technologies/packagist-typo3-cms): 187 vulnerabilities - [wwbn/avideo (Packagist)](https://junglewise.ai/threats/technologies/wwbn-avideo): 164 vulnerabilities - [magento/project-community-edition (Packagist)](https://junglewise.ai/threats/technologies/magento-project-community-edition): 161 vulnerabilities - [drupal/core (Packagist)](https://junglewise.ai/threats/technologies/packagist-drupal-core): 150 vulnerabilities - [pimcore/pimcore (Packagist)](https://junglewise.ai/threats/technologies/pimcore-pimcore): 145 vulnerabilities - [craftcms/cms (Packagist)](https://junglewise.ai/threats/technologies/craftcms-cms): 143 vulnerabilities - [dolibarr/dolibarr (Packagist)](https://junglewise.ai/threats/technologies/dolibarr-dolibarr): 127 vulnerabilities - [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav): 127 vulnerabilities - [typo3/cms-core (Packagist)](https://junglewise.ai/threats/technologies/typo3-cms-core): 127 vulnerabilities - [concrete5/concrete5 (Packagist)](https://junglewise.ai/threats/technologies/concrete5-concrete5): 122 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "phpoffice/phpspreadsheet (Packagist) vulnerabilities", https://junglewise.ai/threats/technologies/phpoffice-phpspreadsheet, 10 November 2026.