PT-2025-34632 · Phpoffice · Phpspreadsheet

Aleksey Solovev · Published 2025-01-15 · Updated 2025-10-01 · CVE-2025-54370

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: PhpOffice/PhpSpreadsheet versions prior to 1.30.0 PhpOffice/PhpSpreadsheet versions prior to 2.1.12 PhpOffice/PhpSpreadsheet versions prior to 2.4.0 PhpOffice/PhpSpreadsheet versions prior to 3.10.0 PhpOffice/PhpSpreadsheet versions prior to 5.0.0

Description: PhpOffice/PhpSpreadsheet is a PHP library used for reading and writing spreadsheet files. A Server-Side Request Forgery (SSRF) can occur when processing HTML documents, potentially allowing an attacker to make requests on behalf of the server. The vulnerability resides in the setPath method of the PhpOfficePhpSpreadsheetWorksheetDrawing class, where a user-supplied string is passed to the HTML reader. Additionally, there is a potential for unsafe deserialization via phar archives and the file exists method.

Recommendations: Update PhpOffice/PhpSpreadsheet to version 1.30.0 or later. Update PhpOffice/PhpSpreadsheet to version 2.1.12 or later. Update PhpOffice/PhpSpreadsheet to version 2.4.0 or later. Update PhpOffice/PhpSpreadsheet to version 3.10.0 or later. Update PhpOffice/PhpSpreadsheet to version 5.0.0 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2025-11115

CVE-2025-54370

GHSA-RX7M-68VC-PPXH

Affected Products

Phpspreadsheet

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54370.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/phpoffice/phpspreadsheet/CVE-2025-54370.yaml · Exploit
• https://bdu.fstec.ru/vul/2025-11115 · Security Note
• https://osv.dev/vulnerability/GHSA-rx7m-68vc-ppxh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54370 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54370 · Vendor Advisory
• https://github.com/PHPOffice/PhpSpreadsheet · Note
• https://github.com/PHPOffice/PhpSpreadsheet/commit/ac4befd2f7ccc21a59daef606a02a3d1828ade09 · Note
• https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-rx7m-68vc-ppxh · Note
• https://github.com/PHPOffice/PhpSpreadsheet/commit/4050f14521d70634c3320b170236574a6106eb39 · Note
• https://github.com/PHPOffice/PhpSpreadsheet/commit/81a0de2261f698404587a6421a5c6eb263c40b31 · Note
• https://github.com/PHPOffice/PhpSpreadsheet/commit/334a67797ace574d1d37c0992ffe283b7415471a · Note
• https://github.com/PHPOffice/PhpSpreadsheet/commit/c2cd0e64392438e4c6af082796eb65c1d629a266 · Note
• https://twitter.com/VulmonFeeds/status/1960035854606270496 · Twitter Post
• https://t.me/pentestingnews/66929 · Telegram Post