How many CVEs have a located fix in PHPOffice/PhpSpreadsheet?

21 published CVEs have a fix traced to functions in PHPOffice/PhpSpreadsheet, touching 77 functions across 25 files.

Which function in PHPOffice/PhpSpreadsheet has been patched by the most CVEs?

generateRow in src/PhpSpreadsheet/Writer/Html.php has been changed by 5 CVE fixes, from 2024 to 2025.

How large is a typical CVE fix in PHPOffice/PhpSpreadsheet?

The median fix changes 27 lines. 43% of fixes change 20 lines or fewer, and 24% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

php

#249 of 500 repositories

PHPOffice/PhpSpreadsheet

Name: PHPOffice/PhpSpreadsheet: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix July 28, 2026

21

CVE fixes located

Published CVEs

77

Functions patched

Distinct function sites

25

Files patched

Distinct source files

2018–2026

Years covered

By CVE publication date

Overview

21 published CVEs have a fix traced to functions in PHPOffice/PhpSpreadsheet, the earliest published in 2018. Those fixes changed 77 distinct functions across 25 files, in 321 patch hunks.

Among the 500 repositories tracked here, PHPOffice/PhpSpreadsheet ranks #249 by the number of CVEs with a located fix.

Most patched functions

Functions in PHPOffice/PhpSpreadsheet changed by the most CVE fixes.

Most patched files

Files in PHPOffice/PhpSpreadsheet changed by the most CVE fixes.

1src/PhpSpreadsheet/Writer/Html.php11 CVEs · 11 functions
2src/PhpSpreadsheet/Reader/Security/XmlScanner.php5 CVEs · 4 functions
3src/PhpSpreadsheet/Reader/Xlsx.php3 CVEs · 10 functions
4src/PhpSpreadsheet/Reader/Gnumeric.php3 CVEs · 7 functions
5src/PhpSpreadsheet/Calculation/MathTrig/Round.php3 CVEs · 3 functions
6src/PhpSpreadsheet/Reader/Xml.php3 CVEs · 3 functions
7src/PhpSpreadsheet/Calculation/MathTrig/Trunc.php3 CVEs · 2 functions
8src/PhpSpreadsheet/Worksheet/Drawing.php3 CVEs · 1 functions
9src/PhpSpreadsheet/Shared/OLERead.php2 CVEs · 5 functions
10src/PhpSpreadsheet/Reader/BaseReader.php2 CVEs · 2 functions

Fix size

How much code a CVE fix in PHPOffice/PhpSpreadsheet changes, with backports counted once.

27

Median lines changed

Added plus removed, per CVE

43%

Fixes of 20 lines or fewer

Share of CVE fixes

24%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in PHPOffice/PhpSpreadsheet, and the functions each fix changed.

PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
CVE-2026-59932setMaxLength Gnumeric catchLoop
High · CVSS 7.5
EPSS 0.7%2026-07-28
PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
CVE-2026-59933setMaxLength Gnumeric catchLoop
High · CVSS 7.5
EPSS 0.7%2026-07-28
PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
CVE-2026-59931webService
High · CVSS 7.7
EPSS 0.5%2026-07-28
PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser
CVE-2025-54370BaseReader
High · CVSS 8.7
EPSS 0.8%2025-08-25
Bypass XSS sanitizer using the javascript protocol and special characters in phpoffice/phpspreadsheet
CVE-2025-23210replaceNonAscii generateRow setPath
Medium · CVSS 4.8
EPSS 0.4%2025-02-03
Cross-Site Scripting (XSS) vulnerability in generateNavigation() function
CVE-2025-22131generateNavigation
Medium · CVSS 5.1
EPSS 0.4%2025-01-20
PhpSpreadsheet allows bypass XSS sanitizer using the javascript protocol and special characters
CVE-2024-56412generateRow generateHTMLHeader
Medium · CVSS 4.8
EPSS 0.4%2025-01-03
PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header
CVE-2024-56411generateRow generateHTMLHeader
Medium · CVSS 4.8
EPSS 0.4%2025-01-03
PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability in custom properties
CVE-2024-56410generateRow generateHTMLHeader
Medium · CVSS 4.8
EPSS 0.3%2025-01-03
PhpSpreadsheet allows unauthorized Reflected XSS in `Convert-Online.php` file
CVE-2024-56408__construct
High · CVSS 8.3
EPSS 0.4%2025-01-03
XXE in PHPSpreadsheet's XLSX reader
CVE-2024-48917findPolyfill findCharSet toUtf8
High · CVSS 7.5
EPSS 0.7%2024-11-18
XmlScanner bypass leads to XXE
CVE-2024-47873findPolyfill findCharSet toUtf8
High · CVSS 7.5
EPSS 0.7%2024-11-18

Get an alert for each new PHPOffice/PhpSpreadsheet CVE, with the patched functions and AI-written analysis.

Monitor PhpSpreadsheet CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

debian/libvirt21 CVEs debian/libxml221 CVEs ethyca/fides21 CVEs flatpressblog/flatpress21 CVEs francoisjacquet/rosariosis21 CVEs FreshRSS/FreshRSS21 CVEs huggingface/transformers21 CVEs ILIAS-eLearning/ILIAS21 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in PHPOffice/PhpSpreadsheet.

How many CVEs have a located fix in PHPOffice/PhpSpreadsheet?: 21 published CVEs have a fix traced to functions in PHPOffice/PhpSpreadsheet, touching 77 functions across 25 files.
Which function in PHPOffice/PhpSpreadsheet has been patched by the most CVEs?: generateRow in src/PhpSpreadsheet/Writer/Html.php has been changed by 5 CVE fixes, from 2024 to 2025.
How large is a typical CVE fix in PHPOffice/PhpSpreadsheet?: The median fix changes 27 lines. 43% of fixes change 20 lines or fewer, and 24% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track PHPOffice/PhpSpreadsheet CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing