CVE-2026-45034

Deferred Deferred - Pending Action

Phar Deserialization RCE in PhpSpreadsheet

Publication date: 2026-06-22

Last updated on: 2026-06-23

Assigner: GitHub, Inc.

Description

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.5, CVE-2026-34084 was patched by the helper File::prohibitWrappers. The helper calls parse_url($filename, PHP_URL_SCHEME) and then checks is_string($scheme) && strlen($scheme) > 1 to reject stream wrappers such as phar://, php://, data:// or expect://. The check is not equivalent to "does the path contain a wrapper". When the input has the form phar:///path/file.phar/inner with three or more slashes after the scheme, parse_url returns boolean false instead of returning the scheme string. The is_string($scheme) branch is therefore skipped, the helper returns without throwing, and the caller proceeds. PHP's stream layer, however, still treats phar:///... as a valid phar wrapper and opens the underlying phar file. The result is that IOFactory::load($attackerPath) walks past the patch and still touches the phar wrapper. On PHP 7.x, simply reaching the phar wrapper via is_file is enough for PHP to automatically deserialize the phar metadata, which in turn invokes the magic methods __wakeup and __destruct of an attacker controlled object and gives full RCE. On PHP 8.x, automatic metadata deserialization for plain file ops was removed, so the chain at the PhpSpreadsheet layer reduces to a phar wrapper file read primitive, and RCE only resurfaces if the downstream consumer ever calls Phar::getMetadata. This vulnerability is fixed in 1.30.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-22

Last Modified

2026-06-23

Generated

2026-07-13

AI Q&A

2026-06-23

EPSS Evaluated

2026-07-11

NVD

CVE-2026-45034

Affected Vendors & Products

Vendor	Product	Version / Range
phpspreadsheet	phpspreadsheet	to 1.30.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the PhpSpreadsheet PHP library prior to version 1.30.5. It involves improper handling of stream wrappers in file paths. The helper function intended to block dangerous wrappers like phar://, php://, data://, or expect:// uses parse_url to detect the scheme. However, when the input path has three or more slashes after the scheme (e.g., phar:///path/file.phar/inner), parse_url returns false instead of the scheme string. This causes the check to be bypassed, allowing the phar wrapper to be processed.

On PHP 7.x, simply accessing the phar wrapper via is_file triggers automatic deserialization of phar metadata, which can invoke attacker-controlled magic methods (__wakeup and __destruct), leading to remote code execution (RCE). On PHP 8.x, this automatic deserialization was removed, so RCE only occurs if the downstream code explicitly calls Phar::getMetadata. The vulnerability was fixed in PhpSpreadsheet version 1.30.5.

Impact Analysis

This vulnerability can lead to remote code execution (RCE) on systems using vulnerable versions of PhpSpreadsheet, especially on PHP 7.x environments. An attacker can craft malicious phar files that, when processed by the library, execute arbitrary code on the server. This can compromise the confidentiality, integrity, and availability of the affected system.

Mitigation Strategies

The vulnerability is fixed in PhpSpreadsheet version 1.30.5. Immediate mitigation involves upgrading PhpSpreadsheet to version 1.30.5 or later.

This update corrects the improper handling of phar stream wrappers that could lead to remote code execution.

Detection Guidance

This vulnerability can be detected by checking if your PhpSpreadsheet installation is using a vulnerable version (<= 1.30.4) and if the code uses the helper File::prohibitWrappers which relies on parse_url to block stream wrappers.

To detect attempts to exploit this vulnerability on your system, you can monitor for usage of phar stream wrappers with three or more slashes after the scheme (e.g., phar:///path/file.phar/inner) in file operations.

Suggested commands to detect suspicious file access patterns or attempts to use phar wrappers include:

Use grep or similar tools to search your codebase for usage of File::prohibitWrappers or calls to parse_url with PHP_URL_SCHEME.
Monitor logs or use system auditing tools (e.g., auditd on Linux) to detect file operations involving paths containing 'phar:///' or similar stream wrappers.
Example command to find suspicious file paths in logs: grep -r 'phar:///' /var/log/
If you have access to the PHP environment, you can run a test script to check if the vulnerable code path is reachable by attempting to load a file with a phar wrapper path containing three or more slashes and observing if it bypasses the wrapper check.

Hi! I’m here to help you understand CVE-2026-45034. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70