Skip to content
Threat Feed
Subscribe

Tag

Phpspreadsheet

4 briefs RSS
medium advisory

PhpSpreadsheet Gnumeric Reader Unbounded Gzip Expansion Leads to Denial of Service

The PhpOffice PhpSpreadsheet library is vulnerable to a denial of service (DoS) attack, identified as CVE-2026-59932, where its Gnumeric reader processes attacker-supplied `.gnumeric` files containing gzipped content without enforcing a decompressed-size limit, causing memory exhaustion and application crashes.

PhpSpreadsheet +4 denial-of-service vulnerability php ghsa software-supply-chain
1t
critical advisory

PhpSpreadsheet SSRF and RCE Vulnerability via IOFactory::load

PhpSpreadsheet is vulnerable to Server-Side Request Forgery (SSRF) and Remote Code Execution (RCE) due to improper validation of filenames in the IOFactory::load function, exploitable via PHP wrappers like `phar://` and `ftp://`.

PhpSpreadsheet ssrf rce php deserialization
2r 2t
medium advisory

PhpSpreadsheet XML Reader Denial of Service via Unbounded Row Index

PhpSpreadsheet is vulnerable to a denial-of-service attack by crafting a SpreadsheetML XML file with an excessively large row index, which exhausts server CPU resources due to unbounded iteration.

PhpSpreadsheet denial-of-service xml
2r 1t
medium advisory

PhpSpreadsheet CPU Denial of Service via Unbounded Row Number

A vulnerability in PhpSpreadsheet exists where a crafted XLSX file containing a large row number can cause excessive CPU consumption due to unbounded loop iterations, leading to a denial of service.

PhpSpreadsheet denial-of-service xlsx php
2r 1t