CVE-2025-54370: PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser
(updated )
Product: PhpSpreadsheet
Version: 3.8.0
CWE-ID: CWE-918: Server-Side Request Forgery (SSRF)
CVSS vector v.3.1: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVSS vector v.4.0: 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N)
Description: SSRF occurs when a processed HTML document is read and displayed in the browser
Impact: Server-Side Request Forgery
Vulnerable component: the PhpOffice\PhpSpreadsheet\Worksheet\Drawing class, setPath method
Exploitation conditions: getting a string from the user that is passed to the HTML reader
Mitigation: improved processing of the $path variable of the setPath method of the PhpOffice\PhpSpreadsheet\Worksheet\Drawing class is needed
Researcher: Aleksey Solovev (Positive Technologies)
References
- github.com/FriendsOfPHP/security-advisories/blob/master/phpoffice/phpspreadsheet/CVE-2025-54370.yaml
- github.com/PHPOffice/PhpSpreadsheet
- github.com/PHPOffice/PhpSpreadsheet/commit/334a67797ace574d1d37c0992ffe283b7415471a
- github.com/PHPOffice/PhpSpreadsheet/commit/4050f14521d70634c3320b170236574a6106eb39
- github.com/PHPOffice/PhpSpreadsheet/commit/81a0de2261f698404587a6421a5c6eb263c40b31
- github.com/PHPOffice/PhpSpreadsheet/commit/ac4befd2f7ccc21a59daef606a02a3d1828ade09
- github.com/PHPOffice/PhpSpreadsheet/commit/c2cd0e64392438e4c6af082796eb65c1d629a266
- github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-rx7m-68vc-ppxh
- github.com/advisories/GHSA-rx7m-68vc-ppxh
- nvd.nist.gov/vuln/detail/CVE-2025-54370
Code Behaviors & Features
Detect and mitigate CVE-2025-54370 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →