Vulnerabilidades de Phpoffice
CVEs publicadas que afetam produtos de Phpoffice: 6 registro(s), com severidade, exploração e correções.
CVE-2026-45034
Crítica · 9.2
CWE-502 22/06/2026
PhpSpreadsheet: bypass da verificação de wrapper phar leva a risco de desserialização
PhpSpreadsheet é uma biblioteca PHP pura para leitura e escrita de arquivos de planilha. Antes da versão 1.30.5, o CVE-2026-34084 foi corrigido pelo auxiliar File::prohibitWrappers. O auxiliar chama parse_url($filename, PHP_URL_SCHEME) e depois verifica is_string($scheme) && strlen($scheme) > 1 para rejeitar wrappers de stream como phar://, php://, data:// ou expect://. A verificação não é equivalente a 'o caminho contém um wrapper'. Quando a entrada tem o formato phar:///path/file.phar/inner, com três ou mais barras após o esquema, parse_url retorna o booleano false em vez de retornar a string do esquema. O ramo is_string($scheme) é então ignorado, o auxiliar retorna sem lançar exceção e o chamador prossegue. A camada de streams do PHP, porém, ainda trata phar:///... como um wrapper phar válido e abre o arquivo phar subjacente. Como resultado, IOFactory::load($attackerPath) ultrapassa a correção e ainda aciona o wrapper phar. No PHP 7.x, basta alcançar o wrapper phar via is_file para que o PHP desserialize automaticamente os metadados do phar, o que por sua vez invoca os métodos mágicos __wakeup e __destruct de um objeto controlado pelo atacante e resulta em execução remota de código completa. No PHP 8.x, a desserialização automática de metadados para operações comuns de arquivo foi removida, então a cadeia na camada do PhpSpreadsheet se reduz a uma primitiva de leitura de arquivo via wrapper phar, e a RCE só reaparece se o consumidor downstream chamar Phar::getMetadata. Esta vulnerabilidade está corrigida na versão 1.30.5.
CVE-2026-40902
Alta · 7.5
CWE-770 12/05/2026
PhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the XLSX reader's ColumnAndRowAttributes::readRowAttributes() method reads row numbers from XML attributes without validating them against the spreadsheet maximum row limit (AddressRange::MAX_ROW = 1,048,576). An attacker can craft a minimal XLSX file (~1.6KB) containing a <row r="999999999"/> element that inflates cachedHighestRow to 999,999,999, causing any subsequent row iteration to attempt ~1 billion loop cycles and exhaust CPU resources. This vulnerability is fixed in 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0.
CVE-2026-40863
Alta · 7.5
CWE-770 12/05/2026
PhpSpreadsheet: CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the SpreadsheetML XML reader (Reader\Xml) does not validate the ss:Index row attribute against the maximum allowed row count (AddressRange::MAX_ROW = 1,048,576). An attacker can craft a SpreadsheetML XML file with ss:Index="999999999" on a <Row> element, which inflates the internal cachedHighestRow to ~1 billion. Any subsequent call to getRowIterator() without an explicit end row will attempt to iterate ~1 billion rows, causing CPU exhaustion and denial of service. This vulnerability is fixed in 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0.
CVE-2026-40296
Média · 5.4
CWE-79 06/05/2026
PhpSpreadsheet vulnerable to XSS in HTML writer via custom number format codes
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The HTML writer skips htmlspecialchars escaping when a cell's formatted value differs from the original value. When a cell has a custom number format containing the text placeholder @ along with any additional literal characters (for example ". @", "@ ", or "x@"), the formatter replaces @ with the cell value and adds the extra characters, causing the formatted value to differ from the original and bypassing HTML escaping entirely. An attacker who can control the cell value and number format of an uploaded spreadsheet that is later converted to HTML and displayed to other users can achieve stored cross-site scripting. This issue is fixed in versions 5.7.0, 3.10.5, 2.4.5, 2.1.16, and 1.30.4.
CVE-2026-35453
Média · 5.4
CWE-79 05/05/2026
PhpSpreadsheet XSS via number format text substitution in HTML Writer
PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.3 and earlier, 2.0.0 through 2.1.15, 2.2.0 through 2.4.4, 3.3.0 through 3.10.4, and 4.0.0 through 5.6.0, the HTML Writer skips htmlspecialchars() output escaping when a cell uses a custom number format containing the @ text placeholder with additional literal text (e.g., @ "items"). The escaping is only applied when the formatted output strictly equals the original cell value. When the format code contains @ with quoted literal text, the formatter substitutes the raw cell value into the format string and returns early without invoking the escaping callback. An attacker who can control cell content in a spreadsheet processed by the HTML Writer can inject arbitrary HTML and JavaScript into the generated output. This issue has been fixed in versions 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0.
CVE-2026-34084
Crítica · 9.8
CWE-502 05/05/2026
PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load
PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.2 and earlier, 2.0.0 through 2.1.14, 2.2.0 through 2.4.3, 3.3.0 through 3.10.3, and 4.0.0 through 5.5.0, when the filename argument to IOFactory::load() is user-controlled, an attacker can supply a PHP stream wrapper path (such as phar://, ftp://, or ssh2.sftp://) that passes the is_file() check in File::assertFile(). The phar:// wrapper triggers deserialization of the PHAR metadata, which can lead to remote code execution if a suitable gadget chain is available in the application. The ftp:// and ssh2.sftp:// wrappers can be used for server-side request forgery. This issue has been fixed in versions 1.30.3, 2.1.15, 2.4.4, 3.10.4, and 5.6.0.