Known vulnerabilities in PhpSpreadsheet

Vendor: PHPOffice
Software CPE: cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*
Total vulnerabilities: 7
Public exploits: 5
Known exploited (KEV): 0
Highest CVSSv4 Score: 8.8

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting PhpSpreadsheet PhpSpreadsheet is affected by 7 known vulnerabilities: 4 medium, 3 low Critical High Medium Low

Vulnerabilities (7)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU138424 - Server-Side Request Forgery (SSRF)
CVE-2026-59931
CWE-918 Medium
Available
No
1.30.6, 2.1.18, 2.4.7, 3.10.7, 5.8.1 20.07.2026 SB2026072021
#VU138423 - Resource exhaustion
CVE-2026-59932
CWE-400 Medium
Available
No
1.30.6, 2.1.18, 2.4.7, 3.10.7, 5.8.1 20.07.2026 SB2026072021
#VU138422 - Resource exhaustion
CVE-2026-59933
CWE-400 Medium
Available
No
1.30.6, 2.1.18, 2.4.7, 3.10.7, 5.8.1 20.07.2026 SB2026072021
#VU127972 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-40296
CWE-79 Low
Available
No
1.30.4, 2.1.16, 2.4.5, 3.10.5, 5.7.0 27.04.2026 SB2026042739
#VU127962 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-35453
CWE-79 Low
Available
No
1.30.4, 2.1.16, 2.4.5, 3.10.5, 5.7.0 27.04.2026 SB2026042739
#VU102065 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-45046
CWE-79 Low
No
No
2.1.0 30.12.2024 SB2024123089
SB20241230139
#VU96732 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2024-45048
CWE-611 Medium
No
No
2.2.1 03.09.2024 SB2024090360
SB20241230139
SB2024090385