# Phpoffice PhpSpreadsheet vulnerabilities Source: https://junglewise.ai/threats/technologies/phpspreadsheet Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/phpspreadsheet.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 14 vulnerabilities in Phpoffice PhpSpreadsheet: 0 in the last 7 days and 5 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-108360, was published on 22 October 2026. 4 vulnerabilities in the last four weeks, up 300% on the four before (1). ## Counts - Last 7 days: 0 - Last 30 days: 4 - Last 90 days: 5 - All time: 14 (2 critical, 0 exploited in the wild) ## About Phpoffice PhpSpreadsheet PHP library for reading and writing spreadsheet files in various formats including Excel and OpenDocument. ## Latest Phpoffice PhpSpreadsheet vulnerabilities - [CVE-2026-108360: PHPOffice PhpSpreadsheet redirect validation bypass in external image loading](https://junglewise.ai/threats/cve-2026-108360-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing) (medium, CVSS 6.4, published 22 Oct 2026) - [CVE-2026-108359: PhpSpreadsheet denial-of-service via unbounded row repetition](https://junglewise.ai/threats/cve-2026-108359-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing) (high, CVSS 4, published 22 Oct 2026) - [CVE-2026-108358: PhpSpreadsheet XmlScanner XML entity expansion denial of service](https://junglewise.ai/threats/cve-2026-108358-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing) (high, CVSS 4, published 22 Oct 2026) - [CVE-2026-108357: PHPOffice PhpSpreadsheet XML entity expansion denial of service](https://junglewise.ai/threats/cve-2026-108357-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing) (high, CVSS 4, published 22 Oct 2026) - [CVE-2026-100242: MediaWiki DataTransfer Extension uncontrolled resource consumption](https://junglewise.ai/threats/cve-2026-100242-dependency-on-vulnerable-third-party-component-and-uncontrolled) (info, published 29 Sep 2026) - [CVE-2026-59932: PHPOffice PhpSpreadsheet denial of service via Gnumeric gzip expansion](https://junglewise.ai/threats/cve-2026-59932-phpoffice-phpspreadsheet-denial-of-service-via-gnumeric-gzip) (high, CVSS 7.5, published 28 Jul 2026) - [CVE-2026-59933: PHPOffice PhpSpreadsheet denial of service in OLE reader](https://junglewise.ai/threats/cve-2026-59933-phpoffice-phpspreadsheet-denial-of-service-in-ole-reader) (high, CVSS 7.5, published 28 Jul 2026) - [CVE-2026-59931: PHPOffice PhpSpreadsheet SSRF bypass in WEBSERVICE domain whitelist](https://junglewise.ai/threats/cve-2026-59931-phpoffice-phpspreadsheet-ssrf-bypass-in-webservice-domain) (high, CVSS 7.7, published 28 Jul 2026) - [CVE-2026-45034: PHPOffice PhpSpreadsheet security bypass in File::prohibitWrappers](https://junglewise.ai/threats/cve-2026-45034-phpoffice-phpspreadsheet-security-bypass-in-file-prohibitwrappers) (critical, CVSS 4, published 22 Jun 2026) - [CVE-2026-40902: PHPOffice PhpSpreadsheet CPU denial of service in XLSX reader](https://junglewise.ai/threats/cve-2026-40902-phpoffice-phpspreadsheet-cpu-denial-of-service-in-xlsx-reader) (high, CVSS 7.5, published 12 May 2026) - [CVE-2026-40863: PHPOffice PhpSpreadsheet denial of service in SpreadsheetML XML reader](https://junglewise.ai/threats/cve-2026-40863-phpspreadsheet-has-cpu-denial-of-service-via-unbounded-row-index) (high, CVSS 7.5, published 12 May 2026) - [CVE-2026-40296: PHPOffice PhpSpreadsheet XSS in HTML writer via number format bypass](https://junglewise.ai/threats/cve-2026-40296-phpoffice-phpspreadsheet-xss-in-html-writer-via-number-format) (medium, CVSS 5.4, published 6 May 2026) - [CVE-2026-35453: PHPOffice PhpSpreadsheet XSS in HTML Writer via NumberFormat](https://junglewise.ai/threats/cve-2026-35453-phpoffice-phpspreadsheet-xss-in-html-writer-via-numberformat) (medium, CVSS 5.4, published 5 May 2026) - [CVE-2026-34084: PHPOffice PhpSpreadsheet RCE and SSRF via PHP Stream Wrappers](https://junglewise.ai/threats/cve-2026-34084-phpoffice-phpspreadsheet-rce-and-ssrf-via-php-stream-wrappers) (critical, CVSS 9.8, published 5 May 2026) ## Most severe Phpoffice PhpSpreadsheet vulnerabilities - [CVE-2026-34084: PHPOffice PhpSpreadsheet RCE and SSRF via PHP Stream Wrappers](https://junglewise.ai/threats/cve-2026-34084-phpoffice-phpspreadsheet-rce-and-ssrf-via-php-stream-wrappers) (critical, CVSS 9.8, published 5 May 2026) - [CVE-2026-45034: PHPOffice PhpSpreadsheet security bypass in File::prohibitWrappers](https://junglewise.ai/threats/cve-2026-45034-phpoffice-phpspreadsheet-security-bypass-in-file-prohibitwrappers) (critical, CVSS 4, published 22 Jun 2026) - [CVE-2026-59931: PHPOffice PhpSpreadsheet SSRF bypass in WEBSERVICE domain whitelist](https://junglewise.ai/threats/cve-2026-59931-phpoffice-phpspreadsheet-ssrf-bypass-in-webservice-domain) (high, CVSS 7.7, published 28 Jul 2026) - [CVE-2026-59932: PHPOffice PhpSpreadsheet denial of service via Gnumeric gzip expansion](https://junglewise.ai/threats/cve-2026-59932-phpoffice-phpspreadsheet-denial-of-service-via-gnumeric-gzip) (high, CVSS 7.5, published 28 Jul 2026) - [CVE-2026-59933: PHPOffice PhpSpreadsheet denial of service in OLE reader](https://junglewise.ai/threats/cve-2026-59933-phpoffice-phpspreadsheet-denial-of-service-in-ole-reader) (high, CVSS 7.5, published 28 Jul 2026) - [CVE-2026-40902: PHPOffice PhpSpreadsheet CPU denial of service in XLSX reader](https://junglewise.ai/threats/cve-2026-40902-phpoffice-phpspreadsheet-cpu-denial-of-service-in-xlsx-reader) (high, CVSS 7.5, published 12 May 2026) - [CVE-2026-40863: PHPOffice PhpSpreadsheet denial of service in SpreadsheetML XML reader](https://junglewise.ai/threats/cve-2026-40863-phpspreadsheet-has-cpu-denial-of-service-via-unbounded-row-index) (high, CVSS 7.5, published 12 May 2026) - [CVE-2026-108358: PhpSpreadsheet XmlScanner XML entity expansion denial of service](https://junglewise.ai/threats/cve-2026-108358-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing) (high, CVSS 4, published 22 Oct 2026) - [CVE-2026-108359: PhpSpreadsheet denial-of-service via unbounded row repetition](https://junglewise.ai/threats/cve-2026-108359-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing) (high, CVSS 4, published 22 Oct 2026) - [CVE-2026-108357: PHPOffice PhpSpreadsheet XML entity expansion denial of service](https://junglewise.ai/threats/cve-2026-108357-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing) (high, CVSS 4, published 22 Oct 2026) ## Vulnerabilities per week 4 vulnerabilities in the last four weeks, up 300% on the four before (1). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 4 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Phpoffice PhpSpreadsheet vulnerabilities", https://junglewise.ai/threats/technologies/phpspreadsheet, 9 November 2026.