Phpoffice · Phpspreadsheet · CVE-2026-45034
**Name of the Vulnerable Software and Affected Versions**
PhpSpreadsheet versions prior to 1.30.5
**Description**
An issue exists in the `File::prohibitWrappers()` function where the use of `parse url()` to detect stream wrappers can be bypassed. When an input contains three or more slashes after the scheme (e.g., `phar:///path/file.phar/inner`), `parse url()` returns a boolean `false` instead of the scheme string, allowing the check to be skipped. This enables the `IOFactory::load()` function to process phar wrappers.
On PHP 7.x, this can lead to remote code execution (RCE) because the system automatically deserializes phar metadata via `is file`, triggering the ` wakeup()` and ` destruct()` magic methods of attacker-controlled objects. On PHP 8.x, the impact is reduced to a phar wrapper file read primitive, as automatic metadata deserialization was removed; RCE would only occur if the downstream consumer calls `Phar::getMetadata()`.
**Recommendations**
Update to version 1.30.5 or newer.
As a temporary workaround, restrict the use of the `IOFactory::load()` function with untrusted input to prevent the processing of malicious phar wrappers.