Vulnerability Database · Packagist · phpoffice/phpspreadsheet · Version
phpoffice/phpspreadsheet 1.13.0
1.13.0 is affected by 6 vulnerabilities.
The vulnerabilities that cover this exact version are listed below with the fixed version to move to.
Critical 1 High 4 Medium 1 Low 0 Unrated 0
-
Database updated 23/Oct/2026
Concerned about your application's security?
Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.
01 Vulnerabilities affecting this version
phpoffice/phpspreadsheet 1.13.0 vulnerabilities
6 vulnerabilities cover phpoffice/phpspreadsheet 1.13.0. Open the full list in the database.
| Vulnerability | Severity | Fixed version | Disclosed |
|---|---|---|---|
| CVE-2026-45034: PHPSpreadsheet Patch Bypass Leading to Remote Code Execution | 9.2 critical | 1.30.5 | 08 Jun 2026 |
| XXE Vulnerability in PHPSpreadsheet | 8.8 high | 1.29.1 | 29 Aug 2024 |
| CVE-2025-54370: PhpSpreadsheet SSRF Vulnerability in HTML Document Processing | 8.7 high | 1.30.0 | 25 Aug 2025 |
| CVE-2024-48917: PHPSpreadsheet XXE Vulnerability in XLSX Reader | 7.5 high | 1.29.4 | 18 Nov 2024 |
| CVE-2024-47873: PhpSpreadsheet XML Scanner Bypass Leading to XXE Vulnerability | 7.5 high | 1.29.4 | 18 Nov 2024 |
| CVE-2020-7776: Cross-site scripting in phpoffice/phpspreadsheet | 6.4 medium | 1.16.0 | 06 May 2021 |
Looking for another version, or everything Vulert holds for phpoffice/phpspreadsheet?
Questions
About phpoffice/phpspreadsheet 1.13.0
Is phpoffice/phpspreadsheet 1.13.0 vulnerable?
Yes. 6 vulnerabilities in the Vulert database cover phpoffice/phpspreadsheet 1.13.0: 1 critical, 4 high, 1 medium and 0 low. Each entry above names the fixed version to move to.
How do I monitor phpoffice/phpspreadsheet for upcoming vulnerabilities?
Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the phpoffice/phpspreadsheet version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.