9.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-34084

CVE-2026-34084: PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load

PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.2 and earlier, 2.0.0 through 2.1.14, 2.2.0 through 2.4.3, 3.3.0 through 3.10.3, and 4.0.0 through 5.5.0, when the filename argument to IOFactory::load() is user-controlled, an attacker can supply a PHP stream wrapper path (such as phar://, ftp://, or ssh2.sftp://) that passes the is_file() check in File::assertFile(). The phar:// wrapper triggers deserialization of the PHAR metadata, which can lead to remote code execution if a suitable gadget chain is available in the application. The ftp:// and ssh2.sftp:// wrappers can be used for server-side request forgery. This issue has been fixed in versions 1.30.3, 2.1.15, 2.4.4, 3.10.4, and 5.6.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-34084

CVE-2026-34084:

9.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
phpoffice/phpspreadsheet	composer	>= 4.0.0, <= 5.5.0	5.6.0
phpoffice/phpspreadsheet	composer	>= 3.3.0, <= 3.10.3	3.10.4
phpoffice/phpspreadsheet	composer	>= 2.2.0, <= 2.4.3	2.4.4
phpoffice/phpspreadsheet	composer	>= 2.0.0, <= 2.1.14	2.1.15
phpoffice/phpspreadsheet	composer	<= 1.30.2	1.30.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) and potential Remote Code Execution (RCE) in the PhpSpreadsheet library, identified as GHSA-q4q6-r8wh-5cgh. The root cause is the improper handling of user-supplied filenames, which are passed to PHP functions like is_file() and file_get_contents(). These functions can process PHP stream wrappers (e.g., phar://, ftp://), allowing an attacker to specify a URL instead of a local file path.

Exploitation occurs when a user-controlled filename is passed to the main IOFactory::load() method. This triggers a chain of internal function calls that attempt to validate and read the file. The core of the vulnerability lies in functions that perform file existence checks without explicitly blocking stream wrappers.

The patch addresses this by introducing a new validation function, PhpOffice\PhpSpreadsheet\Shared\File::prohibitWrappers(), which inspects the filename for URL schemes and throws an exception if one is found. This fix is applied in key file-handling functions:

PhpOffice\PhpSpreadsheet\Shared\File::assertFile(): This central validation function is now secure, protecting most file-reading operations initiated by IOFactory::load().
PhpOffice\PhpSpreadsheet\Reader\Xml::canRead(): This function represented a separate vulnerable path as it directly used file_get_contents(). The patch now routes its validation through the hardened assertFile().
PhpOffice\PhpSpreadsheet\Helper\Downloader::__construct(): This class was also found to have weak path validation, which was strengthened by using realpath() more securely to prevent path traversal and stream wrapper attacks.

During an exploit, these functions would appear in a runtime profile as they are responsible for processing the malicious path that triggers the SSRF or RCE.

Vulnerable functions

PhpOffice\PhpSpreadsheet\Shared\File::assertFile

src/PhpSpreadsheet/Shared/File.php

This function was vulnerable because it directly called `is_file()` on a user-controlled filename. The `is_file()` function in PHP evaluates to true for certain stream wrappers like `phar://` and `ftp://`, allowing an attacker to provide a URL instead of a local file path. This could be exploited for Server-Side Request Forgery (SSRF) or, in the case of `phar://`, Remote Code Execution (RCE) through deserialization. The patch adds a call to `prohibitWrappers()` to block such inputs.

PhpOffice\PhpSpreadsheet\Reader\Xml::canRead

src/PhpSpreadsheet/Reader/Xml.php

This function directly passed the user-provided `$filename` to `file_get_contents()`, which is vulnerable to stream wrapper exploits (SSRF/RCE). An attacker could provide a URL like `ftp://...` or `phar://...` to be processed. The patch mitigates this by adding a call to the newly secured `File::assertFile()` function to validate the filename before it is used.

PhpOffice\PhpSpreadsheet\Helper\Downloader::__construct

src/PhpSpreadsheet/Helper/Downloader.php

The constructor built a file path from user-influenced inputs (`$folder`, `$filename`) and performed checks on it. The original implementation was susceptible to stream wrapper attacks because the validation was insufficient. The patch hardens this by using `realpath()` to resolve the canonical path and immediately checking its validity, which prevents `phar://` and other non-filesystem protocol wrappers from being processed.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.