PhpSpreadsheet is a widely used software library that helps websites read, write, and edit spreadsheet files like Excel and CSV. A security vulnerability exists in multiple older versions of this library, but only impacts sites that let visitor input control which spreadsheet file the library loads. Attackers can exploit this flaw in two main ways. First, they can use special file paths to trigger the library to run their own custom code on your web server, if your site has the right supporting code in place. Second, they can use the flaw to make your server send unauthorized requests to other external systems, a type of attack called server-side request forgery. The affected PhpSpreadsheet versions are 1.30.2 and earlier, 2.0.0 through 2.1.14, 2.2.0 through 2.4.3, 3.3.0 through 3.10.3, and 4.0.0 through 5.5.0. This issue has been fixed in versions 1.30.3, 2.1.15, 2.4.4, 3.10.4, and 5.6.0.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-34084
