A security flaw has been identified in PhpSpreadsheet, a widely used library that helps websites read and write spreadsheet files such as Excel or CSV exports. The vulnerability impacts all PhpSpreadsheet versions up to 1.30.2, 2.0.0 through 2.1.14, 2.2.0 through 2.4.3, 3.3.0 through 3.10.3, and 4.0.0 through 5.5.0.
This issue only poses a risk if your website accepts user-provided file paths for spreadsheets that are processed with PhpSpreadsheet. If exploited, an attacker could submit a specially crafted file path instead of a standard spreadsheet file. This could either allow them to run unauthorized code on your server (if specific supporting code exists in your website) or trick your server into sending requests to systems you did not intend it to access.
Patched versions of PhpSpreadsheet that fix this vulnerability are now available: 1.30.3, 2.1.15, 2.4.4, 3.10.4, and 5.6.0.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-34084
