CVE-2026-45034 Overview
CVE-2026-45034 is an insecure deserialization vulnerability in PhpSpreadsheet, a pure PHP library for reading and writing spreadsheet files. The flaw resides in the File::prohibitWrappers helper that was introduced to remediate CVE-2026-34084. The helper fails to reject phar:// URIs that contain three or more slashes after the scheme, allowing attackers to reach the phar stream wrapper through IOFactory::load(). On PHP 7.x, this triggers automatic phar metadata deserialization and yields remote code execution. The vulnerability is fixed in PhpSpreadsheet 1.30.5.
Critical Impact
Attackers who can influence a file path passed to IOFactory::load() can achieve remote code execution on PHP 7.x through phar metadata deserialization and an arbitrary file read primitive on PHP 8.x.
Affected Products
- PHPOffice PhpSpreadsheet versions prior to 1.30.5
- Applications running PhpSpreadsheet on PHP 7.x (full RCE impact)
- Applications running PhpSpreadsheet on PHP 8.x that subsequently call Phar::getMetadata (RCE resurfaces)
Discovery Timeline
- 2026-06-22 - CVE-2026-45034 published to the National Vulnerability Database
- 2026-06-23 - Last updated in NVD database
Technical Details for CVE-2026-45034
Vulnerability Analysis
The vulnerability is classified as Insecure Deserialization [CWE-502]. PhpSpreadsheet added the File::prohibitWrappers helper to block stream wrappers such as phar://, php://, data://, and expect://. The helper calls parse_url($filename, PHP_URL_SCHEME) and validates the result with is_string($scheme) && strlen($scheme) > 1. This check is not equivalent to verifying that the path contains a wrapper.
When the input is shaped as phar:///path/file.phar/inner with three or more slashes after the scheme, parse_url returns boolean false rather than the scheme string. The is_string branch is skipped, the helper returns without throwing, and the caller proceeds. PHP's stream layer still treats the malformed URI as a valid phar wrapper and opens the underlying phar archive.
Root Cause
The root cause is reliance on parse_url for security-critical wrapper detection. parse_url returns false for URIs PHP considers malformed, yet the PHP stream layer accepts those same URIs and resolves them as phar wrappers. The mismatch between PHP's URL parser and its stream resolver produces a parser-differential bypass of the prohibitWrappers denylist.
Attack Vector
An attacker stages a malicious phar archive on the target file system, for example through an unrelated file upload endpoint. The attacker then supplies a path of the form phar:///absolute/path/to/upload.phar/anything to any consumer that invokes IOFactory::load(). The helper bypass causes is_file to be called against the phar wrapper. On PHP 7.x, this triggers automatic deserialization of the phar metadata, invoking the __wakeup and __destruct magic methods on attacker-controlled objects and producing arbitrary code execution. On PHP 8.x, automatic metadata deserialization for plain file operations was removed, reducing the primitive to a phar wrapper file read unless downstream code explicitly calls Phar::getMetadata.
No verified public proof-of-concept code is available. See the GitHub Security Advisory for the vendor's technical write-up.
Detection Methods for CVE-2026-45034
Indicators of Compromise
- Web server access logs containing parameters or uploaded filenames beginning with phar:// followed by three or more slashes.
- Unexpected .phar files written to upload directories or temp paths used by PHP processes.
- PHP error or audit logs showing IOFactory::load calls referencing wrapper schemes.
Detection Strategies
- Inspect application telemetry for spreadsheet processing functions invoked with paths containing stream wrapper schemes.
- Hunt for PHP child processes spawning shell utilities (sh, bash, curl, wget) shortly after spreadsheet imports.
- Enumerate installed PhpSpreadsheet versions across the estate using software composition analysis and flag any release below 1.30.5.
Monitoring Recommendations
- Alert on writes of files with the .phar extension into directories writable by web users.
- Monitor outbound network connections initiated by PHP-FPM or Apache worker processes immediately following file import operations.
- Capture and retain full request bodies for endpoints that accept user-supplied file paths to support post-incident analysis.
How to Mitigate CVE-2026-45034
Immediate Actions Required
- Upgrade PhpSpreadsheet to version 1.30.5 or later across all applications and dependencies.
- Audit application code for any caller that passes user-controlled values into IOFactory::load() or related readers.
- Remove any .phar files from web-writable directories and restrict write permissions on upload locations.
Patch Information
PhpSpreadsheet 1.30.5 corrects the wrapper detection logic so that malformed phar:// URIs no longer slip past File::prohibitWrappers. Review the PHPOffice PhpSpreadsheet Security Advisory GHSA-87m4-826x-3crx for the authoritative patch and version information.
Workarounds
- Validate and normalize file paths before passing them to PhpSpreadsheet, rejecting any input containing :// or beginning with a non-local scheme.
- Configure PHP with phar.readonly=1 and consider disabling the phar stream wrapper via disable_classes or stream wrapper unregistration where feasible.
- Store uploaded files outside the document root and reference them by opaque identifiers rather than caller-supplied paths.
# Update PhpSpreadsheet via Composer to the fixed release
composer require phpoffice/phpspreadsheet:^1.30.5
# Verify the installed version
composer show phpoffice/phpspreadsheet | grep versions
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
