PatchTheCEVCVE-2026-59932: PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files
44
This month
HIGH 7.5REMOTE
CVE-2026-59932 is a high-severity flaw (CVSS 7.5) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the Gnumeric reader reads attacker-supplied .gnumeric files into memory and, when the file starts with gzip magic bytes, calls gzdecode() on the full compressed contents without enforcing a decompressed-size limit. A very small
Why this priority
- High severity
- Remotely exploitable, no login, no user action
No fix is published yet: follow the downgrade or mitigation steps.
Publisher (CNA): GitHub, Inc.
Timeline
- Published CVE record published
- Updated Record last modified
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.