CVE-2026-45034

Name of the Vulnerable Software and Affected Versions PhpSpreadsheet versions prior to 1.30.5

Description An issue exists in the File::prohibitWrappers() function where the use of parse url() to detect stream wrappers can be bypassed. When an input contains three or more slashes after the scheme (e.g., phar:///path/file.phar/inner), parse url() returns a boolean false instead of the scheme string, allowing the check to be skipped. This enables the IOFactory::load() function to process phar wrappers.

On PHP 7.x, this can lead to remote code execution (RCE) because the system automatically deserializes phar metadata via is file, triggering the wakeup() and destruct() magic methods of attacker-controlled objects. On PHP 8.x, the impact is reduced to a phar wrapper file read primitive, as automatic metadata deserialization was removed; RCE would only occur if the downstream consumer calls Phar::getMetadata().

Recommendations Update to version 1.30.5 or newer. As a temporary workaround, restrict the use of the IOFactory::load() function with untrusted input to prevent the processing of malicious phar wrappers.