PHPOffice vulnerabilities

CVEs per yearBy the year they were published

1. 20249
2. 202511
3. 202615

Newest CVEs

• CVE-2026-108357

  PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service

  PHPOffice · PhpSpreadsheet

  High8.8
• CVE-2026-108359

  PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)

  PHPOffice · PhpSpreadsheet

  High8.7
• CVE-2026-108358

  PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service

  PHPOffice · PhpSpreadsheet

  High8.8
• CVE-2026-108360

  PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading

  PHPOffice · PhpSpreadsheet

  Medium6.4
• CVE-2026-114404

  PHPPresentation 1.2.0 XSS via Writer\HTML Text Runs, Hyperlinks and Descriptions

  PHPOffice · PHPPresentation

  Medium5.3
• CVE-2026-114403

  PHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\Serialized::load

  PHPOffice · PHPPresentation

  Critical9.2
• CVE-2026-59932

  PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion

  PHPOffice · PhpSpreadsheet

  High7.5
• CVE-2026-59933

  PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion

  PHPOffice · PhpSpreadsheet

  High7.5
• CVE-2026-59931

  PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist

  PHPOffice · PhpSpreadsheet

  High7.7
• CVE-2026-45034

  PhpSpreadsheet: File::prohibitWrappers bypass

  PHPOffice · PhpSpreadsheet

  Critical9.2