CVE-2026-45034
PhpSpreadsheet: File::prohibitWrappers bypass
Description
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.5, CVE-2026-34084 was patched by the helper File::prohibitWrappers. The helper calls parse_url($filename, PHP_URL_SCHEME) and then checks is_string($scheme) && strlen($scheme) > 1 to reject stream wrappers such as phar://, php://, data:// or expect://. The check is not equivalent to "does the path contain a wrapper". When the input has the form phar:///path/file.phar/inner with three or more slashes after the scheme, parse_url returns boolean false instead of returning the scheme string. The is_string($scheme) branch is therefore skipped, the helper returns without throwing, and the caller proceeds. PHP's stream layer, however, still treats phar:///... as a valid phar wrapper and opens the underlying phar file. The result is that IOFactory::load($attackerPath) walks past the patch and still touches the phar wrapper. On PHP 7.x, simply reaching the phar wrapper via is_file is enough for PHP to automatically deserialize the phar metadata, which in turn invokes the magic methods __wakeup and __destruct of an attacker controlled object and gives full RCE. On PHP 8.x, automatic metadata deserialization for plain file ops was removed, so the chain at the PhpSpreadsheet layer reduces to a phar wrapper file read primitive, and RCE only resurfaces if the downstream consumer ever calls Phar::getMetadata. This vulnerability is fixed in 1.30.5.
INFO
Published Date :
June 22, 2026, 9:16 p.m.
Last Modified :
Oct. 25, 2026, 11:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 4.0 | CRITICAL | [email protected] |
Solution
- Update PhpSpreadsheet to version 1.30.5 or later.
- Verify library version is not vulnerable.
- Avoid processing untrusted file inputs.
Public PoC/Exploit Available at Github
CVE-2026-45034 has a 1 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-45034.
| URL | Resource |
|---|---|
| https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-87m4-826x-3crx | |
| https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-87m4-826x-3crx |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-45034 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-45034
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.
security cve exploit poc vulnerability
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-45034 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-45034 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 25, 2026
Action Type Old Value New Value Added Translation Title: PhpSpreadsheet de PHPOffice, Description: PhpSpreadsheet es una biblioteca de PHP pura para leer y escribir archivos de hoja de cálculo. Antes de la versión 1.30.5, la CVE-2026-34084 fue parcheada por el ayudante File::prohibitWrappers. El ayudante llama a parse_url($filename, PHP_URL_SCHEME) y luego comprueba is_string($scheme) && strlen($scheme) > 1 para rechazar envoltorios de flujo como phar://, php://, data:// o expect://. La comprobación no es equivalente a ’contiene la ruta un envoltorio’. Cuando la entrada tiene la forma phar:///path/file.phar/inner con tres o más barras después del esquema, parse_url devuelve un booleano falso en lugar de devolver la cadena del esquema. Por lo tanto, la rama is_string($scheme) se omite, el ayudante regresa sin lanzar una excepción, y el llamador procede. La capa de flujo de PHP, sin embargo, todavía trata phar:///... como un envoltorio phar válido y abre el archivo phar subyacente. El resultado es que IOFactory::load($attackerPath) elude el parche y aún toca el envoltorio phar. En PHP 7.x, simplemente alcanzar el envoltorio phar a través de is_file es suficiente para que PHP deserialice automáticamente los metadatos del phar, lo que a su vez invoca los métodos mágicos __wakeup y __destruct de un objeto controlado por el atacante y otorga RCE completa. En PHP 8.x, la deserialización automática de metadatos para operaciones de archivo simples fue eliminada, por lo que la cadena en la capa de PhpSpreadsheet se reduce a una primitiva de lectura de archivo de envoltorio phar, y la RCE solo reaparece si el consumidor posterior alguna vez llama a Phar::getMetadata. Esta vulnerabilidad se corrige en la versión 1.30.5. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 23, 2026
Action Type Old Value New Value Added Reference https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-87m4-826x-3crx Added SSVC {'id': 'CVE-2026-45034', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'yes'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-06-23T15:02:17.578308Z'} -
New CVE Received by [email protected]
Jun. 22, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'PHPOffice', 'product': 'PhpSpreadsheet', 'versions': [{'status': 'affected', 'version': '< 1.30.5'}]}] Added Description PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.5, CVE-2026-34084 was patched by the helper File::prohibitWrappers. The helper calls parse_url($filename, PHP_URL_SCHEME) and then checks is_string($scheme) && strlen($scheme) > 1 to reject stream wrappers such as phar://, php://, data:// or expect://. The check is not equivalent to "does the path contain a wrapper". When the input has the form phar:///path/file.phar/inner with three or more slashes after the scheme, parse_url returns boolean false instead of returning the scheme string. The is_string($scheme) branch is therefore skipped, the helper returns without throwing, and the caller proceeds. PHP's stream layer, however, still treats phar:///... as a valid phar wrapper and opens the underlying phar file. The result is that IOFactory::load($attackerPath) walks past the patch and still touches the phar wrapper. On PHP 7.x, simply reaching the phar wrapper via is_file is enough for PHP to automatically deserialize the phar metadata, which in turn invokes the magic methods __wakeup and __destruct of an attacker controlled object and gives full RCE. On PHP 8.x, automatic metadata deserialization for plain file ops was removed, so the chain at the PhpSpreadsheet layer reduces to a phar wrapper file read primitive, and RCE only resurfaces if the downstream consumer ever calls Phar::getMetadata. This vulnerability is fixed in 1.30.5. Added CVSS V4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-502 Added Reference https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-87m4-826x-3crx