Phpspreadsheet
Vendor:
First CVE: Nov 14, 2018 · Active for 7 years
25
Total CVEs
More Total CVEs than 95% of tracked products
4.2
Avg CVEs / Year
Higher CVE frequency than 86% of tracked products
6.6
Avg CVSS
Higher Avg CVSS than 33% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Phpspreadsheet over time
Volume of CVEsAvg CVSS Base Score
First CVE
Nov 14, 2018
7 years ago
Most Recent CVE
May 12, 2026
73 days ago
CVE Severity & Scoring
Phpspreadsheet25 CVEs
60%
36%
All CVEs352,231 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network25 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low25 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None9 (36.0%)
Unknown0 (0.0%)
Required16 (64.0%)
Privileges Required
Low13 (52.0%)
High0 (0.0%)
None12 (48.0%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (25 CVEs).
25 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-19277HIGH securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file | Nov 14, 2018 | 8.8 | 42 | NO | YES |
CVE-2026-34084CRITICAL PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.2 and earlier, 2.0.0 through 2.1.14, 2.2.0 through 2.4.3, 3.3.0 through 3.10.3, and 4.0.0 th | May 5, 2026 | 9.8 | 38 | NO | NO |
CVE-2024-45293HIGH PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The security scanner responsible for preventing XXE attacks in the XLSX reader can be bypassed by sl | Oct 7, 2024 | 7.5 | 31 | NO | YES |
CVE-2026-40902HIGH PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the XLSX reader's ColumnAndRowAttributes::readRow | May 12, 2026 | 7.5 | 27 | NO | NO |
CVE-2026-40863HIGH PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the SpreadsheetML XML reader (Reader\Xml) does no | May 12, 2026 | 7.5 | 27 | NO | NO |
CVE-2026-40296MEDIUM PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The HTML writer skips htmlspecialchars escaping when a cell's formatted value differs from the origi | May 6, 2026 | 5.4 | 26 | NO | NO |
CVE-2019-12331HIGH PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared in the header. This wa | Nov 7, 2019 | 8.8 | 26 | NO | NO |
CVE-2024-45291HIGH PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file that links images from arbitrary paths. When | Oct 7, 2024 | 8.8 | 25 | NO | NO |
CVE-2026-35453MEDIUM PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.3 and earlier, 2.0.0 through 2.1.15, 2.2.0 through 2.4.4, 3.3.0 through 3.10.4, and 4.0.0 th | May 5, 2026 | 5.4 | 24 | NO | NO |
CVE-2024-48917HIGH PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. The `XmlScanner` class has a scan method which should prevent XXE attacks. However, in a bypass of the pr | Nov 18, 2024 | 7.5 | 22 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (25 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
1 CVE
4.0% of CVEs· 97th percentile
ExploitDB
1 CVE
4.0% of CVEs· 88th percentile
Social Chatter
Signals from CVEs in this product scope (25 CVEs).
Media Mentions
Signals from CVEs in this product scope (25 CVEs).
Top CNAs Publishing CVEs For Phpspreadsheet
Top CWEs
Versions
No cataloged versions.