CVE-2025-54370 PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser
Attackers can trigger Server-Side Request Forgery in PhpSpreadsheet by crafting HTML documents, potentially accessing internal resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-54370?
CVE-2025-54370 is a high-severity server-side request forgery vulnerability in PHPOffice PhpSpreadsheet, published on 25 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PhpOffice/PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to versions 1.30.0, 2.1.12, 2.4.0, 3.10.0, and 5.0.0, SSRF can occur when a processed HTML document is read and displayed in the browser. The vulnerability lies in the setPath method of the PhpOffice\PhpSpreadsheet\Worksheet\Drawing class, where a crafted string from the user is passed to the HTML reader. This issue has been patched in versions 1.30.0, 2.1.12, 2.4.0, 3.10.0, and 5.0.0.
Weakness: CWE-918
Which versions are affected by CVE-2025-54370?
10 open source packages ship an affected version, including phpoffice/phpspreadsheet.
| Package | Affected | Fixed in |
|---|---|---|
phpoffice/phpspreadsheet Packagist | All versions | 1.30.0 |
phpoffice/phpspreadsheet Packagist | All versions | 1.30.0 |
phpoffice/phpspreadsheet Packagist | From 2.0.0 | 2.1.12 |
phpoffice/phpspreadsheet Packagist | From 2.0.0 | 2.1.12 |
phpoffice/phpspreadsheet Packagist | From 2.2.0 | 2.4.0 |
phpoffice/phpspreadsheet Packagist | From 2.2.0 | 2.4.0 |
4 more packages
phpoffice/phpspreadsheet Packagist | From 3.0.0 | 3.10.0 |
phpoffice/phpspreadsheet Packagist | From 3.0.0 | 3.10.0 |
phpoffice/phpspreadsheet Packagist | From 4.0.0 | 5.0.0 |
phpoffice/phpspreadsheet Packagist | From 4.0.0 | 5.0.0 |
How do I fix CVE-2025-54370?
Upgrade phpoffice/phpspreadsheet to a fixed version for your release line: 1.30.0, 2.1.12, 2.4.0 or 3.10.0.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-54370 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-54370 exists.
Sources
Also known as CLSA-2026-1768525047, GHSA-rx7m-68vc-ppxh.