Vulnerability Database · Packagist · phpoffice/phpspreadsheet · Version
phpoffice/phpspreadsheet 5.6.0
5.6.0 is affected by 7 vulnerabilities.
The vulnerabilities that cover this exact version are listed below with the fixed version to move to.
Critical 0 High 5 Medium 2 Low 0 Unrated 0
-
Database updated 23/Oct/2026
Concerned about your application's security?
Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.
01 Vulnerabilities affecting this version
phpoffice/phpspreadsheet 5.6.0 vulnerabilities
7 vulnerabilities cover phpoffice/phpspreadsheet 5.6.0. Open the full list in the database.
| Vulnerability | Severity | Fixed version | Disclosed |
|---|---|---|---|
| CVE-2026-59931: PHPSpreadsheet SSRF Bypass via HTTP Redirect in WEBSERVICE() Domain Whitelist | 7.7 high | 5.8.1 | 23 Jul 2026 |
| CVE-2026-59933: PHPSpreadsheet Memory Exhaustion Due to XLS/OLE Sector-Chain Self-Loop | 7.5 high | 5.8.1 | 23 Jul 2026 |
| CVE-2026-59932: PHPSpreadsheet Gnumeric Reader Unbounded Gzip Expansion Causes Memory Exhaustion | 7.5 high | 5.8.1 | 23 Jul 2026 |
| CVE-2026-40902: PhpSpreadsheet CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions | 7.5 high | 5.7.0 | 29 Apr 2026 |
| CVE-2026-40863: PhpSpreadsheet CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader | 7.5 high | 5.7.0 | 29 Apr 2026 |
| CVE-2026-40296: PhpSpreadsheet XSS Vulnerability via Custom Number Format Codes | 5.4 medium | 5.7.0 | 28 Apr 2026 |
| CVE-2026-35453: PhpSpreadsheet XSS Vulnerability via NumberFormat in HTML Writer | 5.3 medium | 5.7.0 | 28 Apr 2026 |
Looking for another version, or everything Vulert holds for phpoffice/phpspreadsheet?
Questions
About phpoffice/phpspreadsheet 5.6.0
Is phpoffice/phpspreadsheet 5.6.0 vulnerable?
Yes. 7 vulnerabilities in the Vulert database cover phpoffice/phpspreadsheet 5.6.0: 0 critical, 5 high, 2 medium and 0 low. Each entry above names the fixed version to move to.
How do I monitor phpoffice/phpspreadsheet for upcoming vulnerabilities?
Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the phpoffice/phpspreadsheet version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.