CVE-2026-45034: PHPSpreadsheet Patch Bypass Leading to Remote Code Execution

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

PHPSpreadsheet is a widely used library for reading and writing spreadsheet files in PHP. It provides a range of features for handling various spreadsheet formats, making it a popular choice among developers. However, it has been found to have a critical vulnerability that allows attackers to bypass security measures and potentially execute arbitrary code.

Vulnerability Detail

The vulnerability arises from a flaw in the prohibitWrappers helper function, which is intended to prevent the use of stream wrappers like phar://. The function incorrectly relies on parse_url, which can return false for certain inputs, allowing attackers to exploit this bypass. When an attacker uses a specially crafted input, they can trigger the PHP stream layer to treat it as a valid phar wrapper, leading to remote code execution (RCE) on PHP 7.x systems. On PHP 8.x, while the immediate RCE is mitigated, the potential for exploitation remains if downstream consumers invoke certain methods.

composer require phpoffice/phpspreadsheet:1.30.5

Workaround

As a temporary workaround, you can modify the prohibitWrappers function to check for stream wrappers without relying on parse_url. Here is an example of how to implement this:

public static function prohibitWrappers(string $filename): void {
    if (str_contains($filename, ':\/\/')) {
        throw new Exception("Stream wrappers are not permitted as file paths: {$filename}");
    }
}

Conclusion

In summary, CVE-2026-45034 is a critical vulnerability in PHPSpreadsheet that can lead to remote code execution if not addressed. Users are strongly advised to update to the latest version or implement the provided workaround to mitigate the risk.

See every vulnerability recorded for phpoffice/phpspreadsheet →

FAQ