PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored SpreadsheetML XML through XmlScanner::scan in Xml::canRead and Xml::trySimpleXMLLoadStringPrivate, while Xml::unentity decodes numeric entities only after each DOCTYPE pattern check. A double-encoded less-than character is reduced by the first callback to another encoded character and by the second callback to a literal less-than sign, so SimpleXML receives an unchecked DOCTYPE and entity declaration. Processing attacker-controlled SpreadsheetML XML can cause entity-expansion denial of service and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 3.10.8 and 5.10.0.
PhpSpreadsheet versions prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0 contain a vulnerability in the Ods::processTableRow function. This vulnerability allows an attacker to specify an unbounded number of repeated rows in an ODS spreadsheet file, causing uncontrolled resource consumption. The issue can lead to substantial CPU and memory usage, potentially terminating the PHP worker process. This vulnerability has been fixed in the stated versions.
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that accounts for NUL-byte interleaving but not ISO-2022 escape sequences in XLSX XML parts. The escape sequences prevent the scanner from matching the declaration, and XML charset normalization then removes the escape bytes before parsing, exposing a valid DOCTYPE and entity definitions. Processing an attacker-controlled XLSX can therefore cause entity-expansion denial of service on supported PHP versions and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.
CVE-2026-108360 is an authorization vulnerability in PHPOffice PhpSpreadsheet affecting versions prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0. The issue arises when external image URLs are validated only initially, allowing a permitted image host to redirect the server to internal addresses, causing blind GET requests. Although the response body is not exposed to attackers, internal endpoints and cloud metadata services may be accessed. This vulnerability has a medium severity rating with a CVSS score of 6.4 and has been fixed in the specified versions.
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attributes that are emitted unescaped, executing script in viewers' browsers.
PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize(), enabling gadget-chain code execution, file writes, or denial of service.
A resource exhaustion vulnerability exists in reactphp http versions from 1.0.0 up to but not including 1.11.1. The ClientRequestStream::handleData() method appends response-header bytes to an internal buffer without size limits, allowing a remote server to cause unbounded memory growth by sending partial headers without terminating sequences. This can exhaust PHP memory and crash the event loop or worker process. The issue does not affect confidentiality or integrity. It is fixed in version 1.11.1.
FrankenPHP is a modern application server for PHP. Prior to 1.12.5, the official FrankenPHP Debian and Alpine Docker images include a default /app/public/index.php that executes phpinfo(). A derived image that does not overwrite this placeholder serves the diagnostics page in production and can disclose environment variables used for secrets, PHP configuration directives, loaded extensions, software versions, and system paths. Images built using the documented pattern with their own /app/public/index.php are not affected, and already derived images must be rebuilt or supplied with an application index to remove the exposed placeholder. This issue is fixed in version 1.12.5.
CVE-2026-82416 is a race condition vulnerability in FrankenPHP when running in worker mode with PHP's session extension loaded as a shared module rather than statically linked. This causes session IDs to leak between concurrent requests, leading to cross-user session exposure and session hijacking. The issue arises because session state reset code is compiled out when the session extension is shared, allowing stale session IDs to persist across requests. Builds with the session extension statically linked are not affected. The vulnerability results in users being intermittently logged out or served sessions belonging to other users.
CVE-2026-108754 is a vulnerability in tbphp gpt-load up to version 1.4.11 where sensitive client proxy keys are logged in cleartext. This occurs because the Gin Logger middleware logs the raw query string before the authentication key is stripped, exposing proxy keys in console logs or app.log files. Attackers with read access to these logs can recover proxy keys and misuse them against the associated group. The vulnerability has a medium severity with a CVSS score of 4.8.
CVE-2026-105830 is a high-severity denial of service vulnerability in thephpleague commonmark library versions 2.0.0 up to but not including 2.10.2. The flaw exists in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart() method, where an unauthenticated attacker can cause excessive CPU consumption by submitting specially crafted input. This triggers repeated full-buffer scans, leading to quadratic-time resource exhaustion in PHP workers.
League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the DisallowedRawHtml extension by ending raw HTML with a bare disallowed tag name. Attackers can place a lone <script or <iframe line followed by a block supplying attributes like src or onload, executing stored scripts in viewers' browsers under default GFM settings.
Smarty versions before 4.5.8 and 5.x before 5.8.5 contain a code injection vulnerability due to improper handling of the nocache_hash during multi-component template inheritance. This flaw allows attackers to inject arbitrary PHP code via crafted assigned data, leading to remote code execution when the PHP cache file is included.
A vulnerability was determined in PHPGurukul User Registration & Login and User Management System 3.3. The impacted element is an unknown function of the file loginsystem/admin/change-password.php of the component Change Password Handler. This manipulation of the argument currentpassword causes incorrect authorization. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
FilamentPHP versions from 4.0.0 up to but not including 4.13.3 and from 5.0.0 up to but not including 5.8.3 contain a vulnerability where app-based multi-factor authentication (MFA) management actions do not consistently require confirmation of the current password. This allows an attacker with access to an authenticated user session to modify app-based MFA settings or obtain recovery codes without knowing the account password. Email-based MFA is not affected, and the vulnerability does not allow unauthenticated sign-in. The issue is fixed in versions 4.13.3 and 5.8.3.
PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 contain a remote code execution vulnerability due to improper neutralization of directives in dynamically evaluated code. The vulnerability exists in the AbstractArrayDeclarationSniff::getActualArrayKey() method, which uses eval() on array keys, allowing execution of arbitrary PHP code. This affects any sniff extending AbstractArrayDeclarationSniff, including some in PHPCSExtra. The issue is fixed in version 1.2.3. Users who cannot upgrade immediately can mitigate risk by disabling the vulnerable sniffs via custom ruleset exclusions.
CVE-2026-102601 affects thephpleague flysystem, an open source PHP file storage library. Prior to version 3.35.3, the default WhitespacePathNormalizer improperly handles paths containing malformed UTF-8 sequences. This allows certain control characters and raw ANSI escape sequences to bypass path normalization checks, potentially resulting in hidden or spoofed terminal file listings when administrators view directory contents. The issue is fixed in version 3.35.3.
CVE-2026-100900 is a server-side request forgery (SSRF) vulnerability in the DevaslanPHP project-management software affecting versions 1.2.1, 1.2.2, 1.2.3, 1.2.4, and 2.0.0-beta1. The flaw exists in the updateJiraProjects function within the /jira-import component, where manipulation of the host, username, or token parameters can lead to SSRF. The vulnerability can be exploited remotely. The vendor was notified but has not responded or provided a fix. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.1. No patch or mitigation guidance is currently available from the vendor.
A flaw has been found in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1. This impacts the function whereRaw of the file app/Filament/Widgets/Timesheet/MonthlyReport.php of the component Timesheet Dashboard. Executing a manipulation of the argument filter can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.