PhpSpreadsheet is a popular library used by many web applications to read and write spreadsheet files, and older versions of it have a security flaw. This issue only impacts websites where users can submit the filename of a spreadsheet that the site loads using this library.
If your site fits that scenario, an attacker could send a specially crafted file path instead of a normal spreadsheet filename. This bypasses a basic safety check in the library, and can cause two types of harm: in some cases, an attacker can run their own malicious code on your web server if your site uses other common supporting components. In other cases, an attacker can trick your server into sending requests to external systems it should not access, which could lead to data theft or unauthorized access to other parts of your network.
The flaw has been fixed in updated versions of PhpSpreadsheet: 1.30.3, 2.1.15, 2.4.4, 3.10.4, and 5.6.0. If the web app, content management system, or other tool you use to run your site relies on PhpSpreadsheet to handle spreadsheet uploads or processing, you will want to update to one of these fixed versions as soon as it is available to address the risk.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-34084
