{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/phpspreadsheet--2.0.0--2.1.17/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PhpSpreadsheet (\u003c= 1.30.5)","PhpSpreadsheet (\u003e= 2.0.0, \u003c= 2.1.17)","PhpSpreadsheet (\u003e= 2.2.0, \u003c= 2.4.6)","PhpSpreadsheet (\u003e= 3.3.0, \u003c= 3.10.6)","PhpSpreadsheet (\u003e= 4.0.0, \u003c= 5.8.0)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","vulnerability","phpspreadsheet","php","ghsa","software-supply-chain"],"_cs_type":"advisory","_cs_vendors":["PhpOffice"],"content_html":"\u003cp\u003eThe PhpOffice PhpSpreadsheet library, a widely used PHP library for reading and writing spreadsheet files, contains a critical vulnerability (CVE-2026-59932) in its Gnumeric file reader component. When processing an attacker-supplied \u003ccode\u003e.gnumeric\u003c/code\u003e file, the \u003ccode\u003eGnumeric::canRead()\u003c/code\u003e function and subsequent processing paths invoke \u003ccode\u003egzdecode()\u003c/code\u003e on gzipped contents without implementing a maximum decompressed-size limit. This allows a small, specially crafted compressed \u003ccode\u003e.gnumeric\u003c/code\u003e file to expand significantly, consuming excessive memory and leading to a PHP fatal error and process crash. This vulnerability impacts web applications, queue workers, and other services that accept and process untrusted spreadsheet uploads using PhpSpreadsheet, enabling attackers to trigger denial of service conditions by simply providing a malicious file. Affected versions include all PhpSpreadsheet versions up to 1.30.5, and specific ranges within 2.x, 3.x, 4.x, and 5.x.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eInitial Access\u003c/strong\u003e: An attacker crafts a malicious \u003ccode\u003e.gnumeric\u003c/code\u003e file containing a small, highly compressed gzip payload designed to decompress into a significantly larger data size.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eVictim Interaction\u003c/strong\u003e: The attacker uploads this crafted \u003ccode\u003e.gnumeric\u003c/code\u003e file to a vulnerable application that uses the PhpSpreadsheet library for processing spreadsheet files (e.g., via a web form, API endpoint, or email attachment).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eFile Read Initiation\u003c/strong\u003e: The vulnerable application calls PhpSpreadsheet's \u003ccode\u003ePhpOffice\\PhpSpreadsheet\\Reader\\Gnumeric::canRead()\u003c/code\u003e method, or other loading functions, to determine the file type or extract information.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eUnbounded Decompression\u003c/strong\u003e: Inside \u003ccode\u003egzfileGetContents()\u003c/code\u003e, the library detects the gzip magic bytes and proceeds to call \u003ccode\u003egzdecode()\u003c/code\u003e on the entire compressed file contents.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMemory Exhaustion\u003c/strong\u003e: During decompression, the small input file expands to an exceptionally large size (e.g., a 97KB file expands to 96MB), exceeding the PHP process's configured \u003ccode\u003ememory_limit\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eApplication Crash\u003c/strong\u003e: The PHP interpreter encounters a \u0026quot;PHP Fatal error: Allowed memory size exhausted,\u0026quot; leading to the immediate termination of the PHP process or worker handling the request.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDenial of Service\u003c/strong\u003e: The application or service becomes unresponsive or crashes, effectively creating a denial of service condition for legitimate users or operations.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-59932 leads directly to denial of service (DoS) for applications utilizing PhpSpreadsheet. A small, maliciously crafted \u003ccode\u003e.gnumeric\u003c/code\u003e file, for instance, a 97,811-byte file, can expand to approximately 96 MiB during processing. This rapid memory allocation exhausts the PHP process's memory limit (e.g., 64 MiB), causing a fatal error and crashing the application worker. Any service that accepts untrusted spreadsheet uploads, such as document converters, preview services, data import functionalities, or web applications handling user-uploaded files, is susceptible. This can result in service outages, reduced availability, and operational disruptions for affected organizations across various sectors.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003ecomposer/phpoffice/phpspreadsheet\u003c/code\u003e to a patched version immediately to remediate CVE-2026-59932.\u003c/li\u003e\n\u003cli\u003eImplement input validation and file size checks for all user-uploaded spreadsheet files to prevent excessively large files from being processed.\u003c/li\u003e\n\u003cli\u003eConfigure PHP's \u003ccode\u003ememory_limit\u003c/code\u003e to a reasonable, but not unbounded, value for processes handling file uploads, and monitor for sudden spikes in memory usage as a detection mechanism.\u003c/li\u003e\n\u003cli\u003eEnsure that any custom file processing logic that handles gzipped data includes strict limits on the maximum allowed decompressed size.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-23T15:02:28Z","date_published":"2026-07-23T15:02:28Z","id":"https://feed.craftedsignal.io/briefs/2026-07-phpspreadsheet-gnumeric-dos/","summary":"The PhpOffice PhpSpreadsheet library is vulnerable to a denial of service (DoS) attack, identified as CVE-2026-59932, where its Gnumeric reader processes attacker-supplied `.gnumeric` files containing gzipped content without enforcing a decompressed-size limit, causing memory exhaustion and application crashes.","title":"PhpSpreadsheet Gnumeric Reader Unbounded Gzip Expansion Leads to Denial of Service","url":"https://feed.craftedsignal.io/briefs/2026-07-phpspreadsheet-gnumeric-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - PhpSpreadsheet (\u003e= 2.0.0, \u003c= 2.1.17)","version":"https://jsonfeed.org/version/1.1"}