PhpSpreadsheet is a popular tool many websites use to read and write spreadsheet files like Excel or CSV documents. A security flaw tracked as CVE-2026-34084 affects all versions of the tool up to 1.30.2, 2.1.14, 2.4.3, 3.10.3, and 5.5.0.
The flaw only creates a risk if your site uses PhpSpreadsheet to load a spreadsheet file whose name comes directly from user input, such as a filename a visitor submits via a form or upload feature. A bad actor could exploit this gap to either run unauthorized code on your website's server, or trick your server into sending requests to external systems without your permission, which could lead to data leaks or unexpected service issues.
This issue has been fixed in updated versions of PhpSpreadsheet: 1.30.3, 2.1.15, 2.4.4, 3.10.4, and 5.6.0. If you use this tool on your site, make sure you are running one of these fixed versions or a newer release to avoid the risk.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-34084
