CVE-2026-59932

Packagist/phpoffice/phpspreadsheet CVE-2026-59932: high 7.5

PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion

Action: Upgrade phpoffice/phpspreadsheet to 1.30.6 or later.

composer require phpoffice/phpspreadsheet:5.8.1

composer require phpoffice/phpspreadsheet:3.10.7

composer require phpoffice/phpspreadsheet:2.4.7

composer require phpoffice/phpspreadsheet:2.1.18

composer require phpoffice/phpspreadsheet:1.30.6

Affected

Fixed versions

Sources

• osv: GHSA-2mrg-gjxq-2gvr
• https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-2mrg-gjxq-2gvr
• https://github.com/PHPOffice/PhpSpreadsheet/commit/85f2556b0bf5269061bf45932ecda8a128d81750
• https://github.com/PHPOffice/PhpSpreadsheet
• https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6
• https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18
• https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7
• https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7
• https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1

CVE-2026-59932 · published 2026-07-23T15:00:17Z · modified 2026-07-23T16:27:55.110632Z · JSON