CVE-2026-34084
critical
CVSS v3
9.8
CVSS v2
—
VIR risk
9.8
Description
PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled
Predictions
Exploit likelihood
97%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: security-advisories@github.com — https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-q4q6-r8wh-5cgh
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| Packagist | phpoffice/phpspreadsheet | <=1.30.2|>=2.0.0,<=2.1.14|>=2.2.0,<=2.4.3|>=3.3.0,<=3.10.3|>=4.0.0,<=5.5.0 | |
| Packagist | phpoffice/phpspreadsheet | >=4.0.0,<5.6.0 | 5.6.0 |
| Packagist | phpoffice/phpspreadsheet | >=3.3.0,<3.10.4 | 3.10.4 |
| Packagist | phpoffice/phpspreadsheet | >=2.2.0,<2.4.4 | 2.4.4 |
| Packagist | phpoffice/phpspreadsheet | >=2.0.0,<2.1.15 | 2.1.15 |
| Packagist | phpoffice/phpspreadsheet | <1.30.3 | 1.30.3 |
| COMPOSER | phpoffice/phpspreadsheet | <= 1.30.2 | 1.30.3 |
| COMPOSER | phpoffice/phpspreadsheet | >= 2.0.0, <= 2.1.14 | 2.1.15 |
| COMPOSER | phpoffice/phpspreadsheet | >= 2.2.0, <= 2.4.3 | 2.4.4 |
| COMPOSER | phpoffice/phpspreadsheet | >= 3.3.0, <= 3.10.3 | 3.10.4 |
| COMPOSER | phpoffice/phpspreadsheet | >= 4.0.0, <= 5.5.0 | 5.6.0 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| phpoffice | phpspreadsheet | {"endExcluding":"1.30.3"} | 1.30.3 |
References
CWEs
CWE-502 CWE-918
Verify integrity in audit chain (admin only). AS-IS.