UpHeron
All vulnerabilities

Packagist

CVE-2025-54370

PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser

Severity
High
Published
25 Aug 2025
Last changed
29 Aug 2025
Added to UpHeron
22 Oct 2026
Fixed in
1.30.0, 2.1.12, 2.4.0, 3.10.0, 5.0.0
Also known as
GHSA-rx7m-68vc-ppxh
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
phpoffice/phpspreadsheetPackagist · osv:Packagist:phpoffice/phpspreadsheet
  • Every version before 1.30.0
  • From 2.0.0 before 2.1.12
  • From 2.2.0 before 2.4.0
  • From 3.0.0 before 3.10.0
  • From 4.0.0 before 5.0.0

References