CVE-2024-45290

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file which links media from external URLs. When opening the XLSX file, PhpSpreadsheet retrieves the image size and type by reading the file contents, if the provided path is a URL. By using specially crafted `php://filter` URLs an attacker can leak the contents of any file or URL. Note that this vulnerability is different from GHSA-w9xv-qf98-ccq4, and resides in a different component. An attacker can access any file on the server, or leak information form arbitrary URLs, potentially exposing sensitive information such as AWS IAM credentials. This issue has been addressed in release versions 1.29.2, 2.1.1, and 2.3.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-36
• CWE-918

• https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-5gpr-w2p5-6m37Exploit, Patch, Third Party Advisory
• https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-w9xv-qf98-ccq4Not Applicable

Published

Oct 7, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-45285The RFC enabled function module allows a low privileged user…5.4
• CVE-2024-45286Due to lack of proper authorization checks when calling user…6.5
• CVE-2024-45287A malicious value of size in a structure of packed libnv can…7.5
• CVE-2024-45288A missing null-termination character in the last element of …8.4
• CVE-2024-45289The fetch(3) library uses environment variables for passing …7.5
• CVE-2024-4529The Business Card WordPress plugin through 1.0.0 does not ha…5
• CVE-2024-45291PHPSpreadsheet is a pure PHP library for reading and writing…8.8
• CVE-2024-45292PHPSpreadsheet is a pure PHP library for reading and writing…5.4
• CVE-2024-45293PHPSpreadsheet is a pure PHP library for reading and writing…7.5
• CVE-2024-45294The HL7 FHIR Core Artifacts repository provides the java cor…8.6
• CVE-2024-45295Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-45296path-to-regexp turns path strings into a regular expressions…7.5