CVE-2026-34084— PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-34084
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load
Source: NVD (National Vulnerability Database)
Vulnerability Description
PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.2 and earlier, 2.0.0 through 2.1.14, 2.2.0 through 2.4.3, 3.3.0 through 3.10.3, and 4.0.0 through 5.5.0, when the filename argument to IOFactory::load() is user-controlled, an attacker can supply a PHP stream wrapper path (such as phar://, ftp://, or ssh2.sftp://) that passes the is_file() check in File::assertFile(). The phar:// wrapper triggers deserialization of the PHAR metadata, which can lead to remote code execution if a suitable gadget chain is available in the application. The ftp:// and ssh2.sftp:// wrappers can be used for server-side request forgery. This issue has been fixed in versions 1.30.3, 2.1.15, 2.4.4, 3.10.4, and 5.6.0.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
可信数据的反序列化
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| PHPOffice | PhpSpreadsheet | >= 4.0.0, <= 5.5.0 | - |
II. Public POCs for CVE-2026-34084
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-34084
Please Login to view more intelligence information
IV. Related Vulnerabilities
Same product: PhpSpreadsheet
- CVE-2026-40296
PhpSpreadsheet vulnerable to XSS in HTML writer via custom n - CVE-2026-35453
PhpSpreadsheet XSS via number format text substitution in HT - CVE-2025-54370
PhpSpreadsheet vulnerable to SSRF when reading and displayin - CVE-2025-23210
Bypass XSS sanitizer using the javascript protocol and speci - CVE-2025-22131
Cross-Site Scripting (XSS) vulnerability in generateNavigati
Same vendor: PHPOffice
- CVE-2026-40296
PhpSpreadsheet vulnerable to XSS in HTML writer via custom n - CVE-2026-35453
PhpSpreadsheet XSS via number format text substitution in HT - CVE-2025-54370
PhpSpreadsheet vulnerable to SSRF when reading and displayin - CVE-2025-48882
PHPOffice Math allows XXE when processing an XML file in the - CVE-2025-23210
Bypass XSS sanitizer using the javascript protocol and speci
Same weakness: CWE-502
- CVE-2026-5127
User Frontend: AI Powered Frontend Posting, User Directory, - CVE-2026-41586
ObjectInputStream.readObject() without ObjectInputFilter in - CVE-2026-7712
MindsDB Pickle pickle.loads deserialization - CVE-2026-7647
Profile Builder Pro <= 3.14.5 - Unauthenticated PHP Object I - CVE-2026-7597
mem0ai mem0 faiss.py pickle.dump deserialization
V. Comments for CVE-2026-34084
No comments yet