CVE-2026-45034
Received Received - Intake
Phar Deserialization RCE in PhpSpreadsheet

Publication date: 2026-06-22

Last updated on: 2026-06-22

Assigner: GitHub, Inc.

Description
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.5, CVE-2026-34084 was patched by the helper File::prohibitWrappers. The helper calls parse_url($filename, PHP_URL_SCHEME) and then checks is_string($scheme) && strlen($scheme) > 1 to reject stream wrappers such as phar://, php://, data:// or expect://. The check is not equivalent to "does the path contain a wrapper". When the input has the form phar:///path/file.phar/inner with three or more slashes after the scheme, parse_url returns boolean false instead of returning the scheme string. The is_string($scheme) branch is therefore skipped, the helper returns without throwing, and the caller proceeds. PHP's stream layer, however, still treats phar:///... as a valid phar wrapper and opens the underlying phar file. The result is that IOFactory::load($attackerPath) walks past the patch and still touches the phar wrapper. On PHP 7.x, simply reaching the phar wrapper via is_file is enough for PHP to automatically deserialize the phar metadata, which in turn invokes the magic methods __wakeup and __destruct of an attacker controlled object and gives full RCE. On PHP 8.x, automatic metadata deserialization for plain file ops was removed, so the chain at the PhpSpreadsheet layer reduces to a phar wrapper file read primitive, and RCE only resurfaces if the downstream consumer ever calls Phar::getMetadata. This vulnerability is fixed in 1.30.5.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-22
Last Modified
2026-06-22
Generated
2026-06-23
AI Q&A
2026-06-23
EPSS Evaluated
N/A
NVD
CVE-2026-45034
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
phpspreadsheet phpspreadsheet to 1.30.5 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the PhpSpreadsheet PHP library prior to version 1.30.5. It involves improper handling of stream wrappers in file paths. The helper function intended to block dangerous wrappers like phar://, php://, data://, or expect:// uses parse_url to detect the scheme. However, when the input path has three or more slashes after the scheme (e.g., phar:///path/file.phar/inner), parse_url returns false instead of the scheme string. This causes the check to be bypassed, allowing the phar wrapper to be processed.

On PHP 7.x, simply accessing the phar wrapper via is_file triggers automatic deserialization of phar metadata, which can invoke attacker-controlled magic methods (__wakeup and __destruct), leading to remote code execution (RCE). On PHP 8.x, this automatic deserialization was removed, so RCE only occurs if the downstream code explicitly calls Phar::getMetadata. The vulnerability was fixed in PhpSpreadsheet version 1.30.5.

Impact Analysis

This vulnerability can lead to remote code execution (RCE) on systems using vulnerable versions of PhpSpreadsheet, especially on PHP 7.x environments. An attacker can craft malicious phar files that, when processed by the library, execute arbitrary code on the server. This can compromise the confidentiality, integrity, and availability of the affected system.

Mitigation Strategies

The vulnerability is fixed in PhpSpreadsheet version 1.30.5. Immediate mitigation involves upgrading PhpSpreadsheet to version 1.30.5 or later.

This update corrects the improper handling of phar stream wrappers that could lead to remote code execution.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45034. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart