CVE-2025-54370: Phpoffice Phpspreadsheet

High severity, CVSS 8.7. EPSS: 0.8% chance of exploitation in the next 30 days.

PhpOffice/PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to versions 1.30.0, 2.1.12, 2.4.0, 3.10.0, and 5.0.0, SSRF can occur when a processed HTML document is read and displayed in the browser. The vulnerability lies in the setPath method of the PhpOffice\PhpSpreadsheet\Worksheet\Drawing class, where a crafted string from the user is passed to the HTML reader. This issue has been patched in versions 1.30.0, 2.1.12, 2.4.0, 3.10.0, and 5.0.0.

Affected products

• Phpoffice Phpspreadsheet: before 1.30.0 (fixed in 1.30.0); from 2.0.0, before 2.1.12 (fixed in 2.1.12); from 2.2.0, before 2.4.0 (fixed in 2.4.0); from 3.0.0, before 3.10.0 (fixed in 3.10.0); from 4.0.0, before 5.0.0 (fixed in 5.0.0)

Published 2025-08-25. Last modified 2026-06-17.