CVE-2026-34084 PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load
Attackers can trigger SSRF or remote code execution via PHP stream wrappers when user-controlled filenames are passed to IOFactory::load.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-34084?
CVE-2026-34084 is a critical server-side request forgery vulnerability in PHPOffice PhpSpreadsheet, published on 5 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.2 and earlier, 2.0.0 through 2.1.14, 2.2.0 through 2.4.3, 3.3.0 through 3.10.3, and 4.0.0 through 5.5.0, when the filename argument to IOFactory::load() is user-controlled, an attacker can supply a PHP stream wrapper path (such as phar://, ftp://, or ssh2.sftp://) that passes the is_file() check in File::assertFile(). The phar:// wrapper triggers deserialization of the PHAR metadata, which can lead to remote code execution if a suitable gadget chain is available in the application. The ftp:// and ssh2.sftp:// wrappers can be used for server-side request forgery. This issue has been fixed in versions 1.30.3, 2.1.15, 2.4.4, 3.10.4, and 5.6.0.
Which versions are affected by CVE-2026-34084?
10 open source packages ship an affected version, including phpoffice/phpspreadsheet. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
phpoffice/phpspreadsheet Packagist | All versions | 1.30.3 |
phpoffice/phpspreadsheet Packagist | All versions | 1.30.3 |
phpoffice/phpspreadsheet Packagist | From 2.0.0 | 2.1.15 |
phpoffice/phpspreadsheet Packagist | From 2.0.0 | 2.1.15 |
phpoffice/phpspreadsheet Packagist | From 2.2.0 | 2.4.4 |
phpoffice/phpspreadsheet Packagist | From 2.2.0 | 2.4.4 |
4 more packages
phpoffice/phpspreadsheet Packagist | From 3.3.0 | 3.10.4 |
phpoffice/phpspreadsheet Packagist | From 3.3.0 | 3.10.4 |
phpoffice/phpspreadsheet Packagist | From 4.0.0 | 5.6.0 |
phpoffice/phpspreadsheet Packagist | From 4.0.0 | 5.6.0 |
Products include Phpoffice Phpspreadsheet.
How do I fix CVE-2026-34084?
Upgrade phpoffice/phpspreadsheet to a fixed version for your release line: 1.30.3, 2.1.15, 2.4.4 or 3.10.4.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-34084 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34084 exists.
Other vulnerabilities in PHPOffice PhpSpreadsheet
- CVE-2024-45048 XML External Entity Reference (XXE) in PHPSpreadsheet
- CVE-2019-12331 XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue
- CVE-2018-19277 XXE in PHPSpreadsheet due to encoding issue
- CVE-2024-56365 PhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader class
- CVE-2024-56366 PhpSpreadsheet vulnerable to unauthorized reflected XSS in the Accounting.php file
Sources
Also known as GHSA-q4q6-r8wh-5cgh.