CVE-2026-45034

PhpSpreadsheet: File::prohibitWrappers bypass

Published Jun 22, 2026 CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Description

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.5, CVE-2026-34084 was patched by the helper File::prohibitWrappers. The helper calls parse_url($filename, PHP_URL_SCHEME) and then checks is_string($scheme) && strlen($scheme) > 1 to reject stream wrappers such as phar://, php://, data:// or expect://. The check is not equivalent to "does the path contain a wrapper". When the input has the form phar:///path/file.phar/inner with three or more slashes after the scheme, parse_url returns boolean false instead of returning the scheme string. The is_string($scheme) branch is therefore skipped, the helper returns without throwing, and the caller proceeds. PHP's stream layer, however, still treats phar:///... as a valid phar wrapper and opens the underlying phar file. The result is that IOFactory::load($attackerPath) walks past the patch and still touches the phar wrapper. On PHP 7.x, simply reaching the phar wrapper via is_file is enough for PHP to automatically deserialize the phar metadata, which in turn invokes the magic methods __wakeup and __destruct of an attacker controlled object and gives full RCE. On PHP 8.x, automatic metadata deserialization for plain file ops was removed, so the chain at the PhpSpreadsheet layer reduces to a phar wrapper file read primitive, and RCE only resurfaces if the downstream consumer ever calls Phar::getMetadata. This vulnerability is fixed in 1.30.5.

Analysis

Technical impact

The vulnerability stems from PhpSpreadsheet's File::prohibitWrappers improperly rejecting certain stream wrapper paths, allowing a specially crafted phar URL to bypass the guard and enable PHP to deserialize attacker‑controlled objects. This mis‑validation leads to arbitrary code execution, exploiting a deserialization flaw (CWE‑502). On PHP 7.x, simply reaching the wrapper triggers __wakeup and __destruct, making RCE immediate; on PHP 8.x, the same wrapper still permits a vulnerable deserialization chain if downstream code calls Phar::getMetadata.

Affected Systems

The flaw exists in PHPOffice PhpSpreadsheet versions prior to 1.30.5. Any PHP application that uses these older releases and exposes the IOFactory::load function to user input is impacted, whether running PHP 7.x or PHP 8.x. Systems that have not applied the 1.30.5 patch remain vulnerable.

Risk and Exploitability

With a CVSS score of 9.2 the issue is considered critical. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector is remote exploitation. Based on the description, it is inferred that an attacker can supply a crafted phar://… path through a web form or API that ultimately calls IOFactory::load, leading to code execution on PHP 7.x or when metadata functions are used in PHP 8.x.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

PHPOffice

PhpSpreadsheet

affected

Version	Status	Constraints
`< 1.30.5`	affected	—

No data.

Vendor Product Versions

Phpoffice

Phpspreadsheet

Version	Status	Scheme	Platform
`[0,1.30.5)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update PhpSpreadsheet to version 1.30.5 or later to apply the official patch.
If an upgrade cannot be performed immediately, counteract the vulnerability by disabling phar://, php://, data://, and expect:// stream wrappers in the PHP configuration or by calling stream_wrapper_disable for these schemes.
Ensure that any path supplied to IOFactory::load is sanitized, validated against permitted directories, and strictly controlled to prevent the injection of malicious wrapper URLs.

Generated by OpenCVE AI on June 22, 2026 at 22:50 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-87m4-826x-3crx	PHPSpreadsheet has a patch bypass for CVE-2026-34084

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.462% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact total

References

Link	Providers
https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-87m4-826x-3crx

History

Jun 23, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 23, 2026 12:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Phpoffice Phpoffice phpspreadsheet
Vendors & Products		Phpoffice Phpoffice phpspreadsheet

Jun 22, 2026 9:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.5, CVE-2026-34084 was patched by the helper File::prohibitWrappers. The helper calls parse_url($filename, PHP_URL_SCHEME) and then checks is_string($scheme) && strlen($scheme) > 1 to reject stream wrappers such as phar://, php://, data:// or expect://. The check is not equivalent to "does the path contain a wrapper". When the input has the form phar:///path/file.phar/inner with three or more slashes after the scheme, parse_url returns boolean false instead of returning the scheme string. The is_string($scheme) branch is therefore skipped, the helper returns without throwing, and the caller proceeds. PHP's stream layer, however, still treats phar:///... as a valid phar wrapper and opens the underlying phar file. The result is that IOFactory::load($attackerPath) walks past the patch and still touches the phar wrapper. On PHP 7.x, simply reaching the phar wrapper via is_file is enough for PHP to automatically deserialize the phar metadata, which in turn invokes the magic methods __wakeup and __destruct of an attacker controlled object and gives full RCE. On PHP 8.x, automatic metadata deserialization for plain file ops was removed, so the chain at the PhpSpreadsheet layer reduces to a phar wrapper file read primitive, and RCE only resurfaces if the downstream consumer ever calls Phar::getMetadata. This vulnerability is fixed in 1.30.5.
Title		PhpSpreadsheet: File::prohibitWrappers bypass
Weaknesses		CWE-502
References		https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-87m4-826x-3crx
Metrics		cvssV4_0 `{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`