PHPOffice has 6 CVEs on record. Disclosures have slowed: 2 in the last 90 days after 4 in the 90 before. The busiest recent month was July 2026 with 3. The median CVSS is 7.5 (high), with 1 rated critical. None have a confirmed exploitation report. Most affected products: phpoffice/phpspreadsheet (4), PHPPresentation (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 2 prev 4
Products
- phpoffice/phpspreadsheet 4
- PHPPresentation 2
Worst active — by depth score
CVE-2026-45034CriticalPHPSpreadsheet has a patch bypass for CVE-2026-34084 64CVE-2026-114403High· 8.1PHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\Serialized::load45CVE-2026-59931High· 7.7PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist42CVE-2026-59933High· 7.5PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion41CVE-2026-59932High· 7.5PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion41
PHPOffice vulnerabilities
CVEs affecting PHPOffice, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-114404Medium· 6.1PHPPresentation 1.2.0 XSS via Writer\HTML Text Runs, Hyperlinks and Descriptions
PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text r…
CVE-2026-114403High· 8.1PHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\Serialized::load
PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPres…
CVE-2026-59931High· 7.7PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
CVE-2026-59932High· 7.5PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
CVE-2026-59933High· 7.5PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
CVE-2026-45034CriticalPoCPHPSpreadsheet has a patch bypass for CVE-2026-34084
PHPSpreadsheet has a patch bypass for CVE-2026-34084