Deserialization Vulnerability in PhpSpreadsheet Library by PhpOffice
CVE-2026-34084

9.2CRITICAL

Key Information:

Vendor

PHPoffice

Status
PHPspreadsheet
Vendor
CVE Published:
5 May 2026

What is CVE-2026-34084?

The PhpSpreadsheet library contains a security flaw that arises when user-supplied filenames are processed by the IOFactory::load() method. This vulnerability allows attackers to exploit user-controlled filename arguments, leading to potential remote code execution through the use of PHP stream wrappers such as phar://, ftp://, or ssh2.sftp://. The phar:// wrapper, in particular, can trigger the deserialization of PHAR metadata, making it susceptible to exploitation via suitable gadget chains present in the application. This issue has been addressed in subsequent versions of the library.

Affected Version(s)

PhpSpreadsheet >= 4.0.0, <= 5.5.0 <= 4.0.0, 5.5.0

PhpSpreadsheet >= 3.3.0, <= 3.10.3 <= 3.3.0, 3.10.3

PhpSpreadsheet >= 2.2.0, <= 2.4.3 <= 2.2.0, 2.4.3

References

https://github.com/PHPOffice/PhpSpreadsheet/security/advi...
x_refsource_CONFIRM

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.