UpHeron
All vulnerabilities

Packagist

CVE-2026-34084

PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled

Severity
Critical
Published
29 Apr 2026
Last changed
8 May 2026
Added to UpHeron
22 Oct 2026
Fixed in
1.30.3, 2.1.15, 2.4.4, 3.10.4, 5.6.0
Also known as
GHSA-q4q6-r8wh-5cgh
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
phpoffice/phpspreadsheetPackagist · osv:Packagist:phpoffice/phpspreadsheet
  • Every version before 1.30.3
  • From 2.0.0 before 2.1.15
  • From 2.2.0 before 2.4.4
  • From 3.3.0 before 3.10.4
  • From 4.0.0 before 5.6.0

References