Threats tagged 'ghsa-q4q6-r8wh-5cgh'

PhpSpreadsheet versions prior to 5.6.0, 3.10.4, 2.4.4, 2.1.15, and 1.30.3 contain a vulnerability in the IOFactory::load function where user-controlled filenames can exploit PHP stream wrappers such as phar://, ftp://, and ssh2.sftp://. This leads to Server-Side Request Forgery (SSRF) and potentially Remote Code Execution (RCE) through deserialization of malicious Phar archives. The vulnerability arises because the is_file check used to validate filenames is PHP wrapper aware, allowing attackers to bypass file validation. A proof of concept demonstrates creating a malicious Phar file that executes arbitrary shell commands upon loading. The issue affects multiple versions and has been fixed in the stated versions.