CVE-2025-54370

Name of the Vulnerable Software and Affected Versions: PhpOffice/PhpSpreadsheet versions prior to 1.30.0 PhpOffice/PhpSpreadsheet versions prior to 2.1.12 PhpOffice/PhpSpreadsheet versions prior to 2.4.0 PhpOffice/PhpSpreadsheet versions prior to 3.10.0 PhpOffice/PhpSpreadsheet versions prior to 5.0.0

Description: PhpOffice/PhpSpreadsheet is a PHP library used for reading and writing spreadsheet files. A Server-Side Request Forgery (SSRF) can occur when processing HTML documents, potentially allowing an attacker to make requests on behalf of the server. The vulnerability resides in the setPath method of the PhpOfficePhpSpreadsheetWorksheetDrawing class, where a user-supplied string is passed to the HTML reader. Additionally, there is a potential for unsafe deserialization via phar archives and the file exists method.

Recommendations: Update PhpOffice/PhpSpreadsheet to version 1.30.0 or later. Update PhpOffice/PhpSpreadsheet to version 2.1.12 or later. Update PhpOffice/PhpSpreadsheet to version 2.4.0 or later. Update PhpOffice/PhpSpreadsheet to version 3.10.0 or later. Update PhpOffice/PhpSpreadsheet to version 5.0.0 or later.