SB2026101342 - Deserialization of Untrusted Data in PhpSpreadsheet

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026101342

SB2026101342 - Deserialization of Untrusted Data in PhpSpreadsheet

Published: October 13, 2026

Security Bulletin ID SB2026101342
CSH Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Deserialization of Untrusted Data (CVE-ID: CVE-2026-45034)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper stream-wrapper validation in File::prohibitWrappers when processing attacker-controlled file paths through IOFactory::load. A remote attacker can supply a phar wrapper path with three or more slashes after the scheme that references an archive containing attacker-controlled metadata to execute arbitrary code.

Exploitation requires the crafted archive to be accessible to the application. On PHP 7.x, file operations automatically deserialize phar metadata. On PHP 8.x, exploitation requires a downstream call to Phar::getMetadata, which is not present in PhpSpreadsheet.


Remediation

Install update from vendor's website.

References