CVE-2026-45034 PhpSpreadsheet: File::prohibitWrappers bypass
Attackers can bypass wrapper restrictions to trigger unsafe deserialization in PhpSpreadsheet, leading to remote code execution on PHP 7.x or file reads on PHP 8.x.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45034?
CVE-2026-45034 is a critical unsafe deserialization vulnerability in PHPOffice PhpSpreadsheet, published on 22 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.5, CVE-2026-34084 was patched by the helper File::prohibitWrappers. The helper calls parse_url($filename, PHP_URL_SCHEME) and then checks is_string($scheme) && strlen($scheme) > 1 to reject stream wrappers such as phar://, php://, data:// or expect://. The check is not equivalent to "does the path contain a wrapper". When the input has the form phar:///path/file.phar/inner with three or more slashes after the scheme, parse_url returns boolean false instead of returning the scheme string. The is_string($scheme) branch is therefore skipped, the helper returns without throwing, and the caller proceeds. PHP's stream layer, however, still treats phar:///... as a valid phar wrapper and opens the underlying phar file. The result is that IOFactory::load($attackerPath) walks past the patch and still touches the phar wrapper. On PHP 7.x, simply reaching the phar wrapper via is_file is enough for PHP to automatically deserialize the phar metadata, which in turn invokes the magic methods __wakeup and __destruct of an attacker controlled object and gives full RCE. On PHP 8.x, automatic metadata deserialization for plain file ops was removed, so the chain at the PhpSpreadsheet layer reduces to a phar wrapper file read primitive, and RCE only resurfaces if the downstream consumer ever calls Phar::getMetadata. This vulnerability is fixed in 1.30.5.
Weakness: CWE-502
Which versions are affected by CVE-2026-45034?
2 open source packages ship an affected version, including phpoffice/phpspreadsheet.
| Package | Affected | Fixed in |
|---|---|---|
phpoffice/phpspreadsheet Packagist | All versions | 1.30.5 |
phpoffice/phpspreadsheet Packagist | All versions | 1.30.5 |
How do I fix CVE-2026-45034?
Upgrade phpoffice/phpspreadsheet to 1.30.5 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-45034 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45034 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-87m4-826x-3crx.