CVE Tools
Track your stack

Phpoffice

13 CVEs tracked since 2024. Since Oct 2024, none of them reached CISA KEV.

Phpoffice CVEs per month

Oct 2024 to Jan 2025. Point at a month, or focus the strip and use the arrow keys.
Phpoffice CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2024-1050
2024-11null or fewer
2024-12null or fewer
2025-0180

Products

The products that kept showing up in Phpoffice's monthly top three, with their CVEs summed over those months.

  1. Phpspreadsheet132 months

Latest CVEs

The 15 most recently published vulnerabilities affecting Phpoffice.

  1. CVE-2026-59932PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion7.5
  2. CVE-2026-59933PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion7.5
  3. CVE-2026-59931PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist7.7
  4. CVE-2026-45034PhpSpreadsheet: File::prohibitWrappers bypass—
  5. CVE-2026-40863PhpSpreadsheet: CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader7.5
  6. CVE-2026-40902PhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions7.5
  7. CVE-2026-40296PhpSpreadsheet vulnerable to XSS in HTML writer via custom number format codes5.4
  8. CVE-2026-35453PhpSpreadsheet XSS via number format text substitution in HTML Writer5.4
  9. CVE-2026-34084PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load9.8
  10. CVE-2025-54370PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser7.5
  11. CVE-2025-48882PHPOffice Math allows XXE when processing an XML file in the MathML format7.5
  12. CVE-2025-23210Bypass XSS sanitizer using the javascript protocol and special characters in phpoffice/phpspreadsheet6.4
  13. CVE-2025-22131Cross-Site Scripting (XSS) vulnerability in generateNavigation() function6.1
  14. CVE-2024-56412PhpSpreadsheet vulnerable to bypass of the XSS sanitizer using the javascript protocol and special characters5.4
  15. CVE-2024-56411PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header5.4

The record

Peak rank
#107 in Jan 2025
Busiest month shown
Jan 2025, 8 CVEs
Months with a KEV entry
0 since Oct 2024
Monthly snapshots
2 since 2024
Phpoffice's full record, month by month

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store