CVE Intelligence
Analysis AI-assisted

CVE-2026-45034: PhpSpreadsheet phar Wrapper Check Bypass Leading to Deserialization Risk

PhpSpreadsheet versions before 1.30.5 contain a bypass of an earlier fix for CVE-2026-34084, where a crafted phar path defeats the wrapper check. According to the GitHub advisory, this can lead to deserialization of attacker-controlled phar metadata, and the CNA assigned a critical CVSS 4.0 score of 9.2. The issue is fixed in 1.30.5, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The GitHub Security Advisory describes a bypass of an earlier fix (CVE-2026-34084) in the File::prohibitWrappers helper, which is meant to reject stream wrappers such as phar. According to the advisory, a crafted phar path with three or more slashes after the scheme causes the check to be skipped while PHP still opens the phar wrapper. See GHSA-87m4-826x-3crx for the vendor description.

Impact

  • According to the advisory, on PHP 7.x reaching the phar wrapper can trigger automatic deserialization of phar metadata and remote code execution.
  • According to the advisory, on PHP 8.x the chain is reduced to a phar wrapper file read primitive, and code execution depends on downstream code calling Phar::getMetadata.
  • The CNA assigned CVSS 4.0 base score 9.2 with network attack vector, low complexity, no privileges and no user interaction, with high confidentiality, integrity and availability impact.
  • The weakness is classified as CWE-502, Deserialization of Untrusted Data.
  • Inference: applications that pass user-influenced file paths to IOFactory::load are the most relevant exposure.

Affected products and versions

  • The advisory describes PhpSpreadsheet versions prior to 1.30.5 as affected.
  • The structured affected list in the record is empty, so the exact range and any earlier unaffected versions are unknown from the sources consulted.
  • The advisory states the issue is fixed in 1.30.5. The structured fixes list in the record is empty.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record provided.
  • No confirmed active exploitation or exploitation in the wild appears in the sources consulted.
  • EPSS data is not available in the record, so exploitation likelihood is unknown.

Remediation and mitigation

  • Upgrade PhpSpreadsheet to version 1.30.5 or later, as stated by the advisory.
  • If an immediate upgrade is not possible, avoid passing user-supplied filenames or paths to IOFactory::load and restrict file inputs to trusted, validated locations.
  • Review whether PHP stream wrappers such as phar are needed in the environment and restrict them where feasible.
  • Review downstream code for calls to Phar::getMetadata, since the advisory ties the most severe impact on PHP 8.x to that call.
  • Confirm the PHP version in use, because the advisory describes different impacts for PHP 7.x and PHP 8.x.

Detection guidance

  • Inventory projects that depend on PhpSpreadsheet and record the installed version from lock files or deployed packages.
  • Review application logs for file-loading operations that receive stream wrapper schemes in user-supplied input.
  • Monitor PHP worker processes for unexpected child processes or outbound connections after spreadsheet import activity.

Limitations of the available information

  • The record has no title, so the titles in this analysis are derived from the description.
  • The structured affected and fixes lists are empty; version details rely on the description text.
  • No EPSS, SSVC or KEV exploitation details are provided.
  • The source status is Deferred, and the only vendor reference in the record is the GitHub advisory.
  • The NVD and CVE.org pages are listed as source pages, but their content was not provided.
  • Details of the original CVE-2026-34084 are not included in the record.
  • Proof-of-concept or public exploit availability is unknown.

Frequently asked questions

Which PhpSpreadsheet versions are affected by CVE-2026-45034?

The advisory describes versions prior to 1.30.5 as affected. The structured affected list in the record is empty, so the exact range is unknown from the sources consulted.

What is the recommended fix?

According to the GitHub advisory, the issue is fixed in PhpSpreadsheet 1.30.5. Upgrading to that version or later is the primary remediation.

Is this vulnerability being actively exploited?

The record shows the CVE is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.