CVE-2026-34084: 
PHP vulnerability analysis and mitigation

CVE-2026-34084 is a stream wrapper bypass vulnerability in PhpSpreadsheet's IOFactory::load() function that enables Server-Side Request Forgery (SSRF) and Remote Code Execution (RCE) when the filename argument is user-controlled. It affects versions 1.30.2 and earlier, 2.0.0–2.1.14, 2.2.0–2.4.3, 3.3.0–3.10.3, and 4.0.0–5.5.0 of the phpoffice/phpspreadsheet Composer package. The vulnerability was published on April 28, 2026, and patched versions were released on May 8, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.2 (Critical) (GitHub Advisory, Feedly).

The root cause is improper input validation in File::assertFile(), which uses PHP's is_file() to verify that a supplied filename refers to a real file (CWE-502, CWE-918). Because is_file() is PHP stream-wrapper-aware, wrappers such as phar://, ftp://, and ssh2.sftp:// pass the check without restriction. When a phar:// path is supplied, PHP automatically deserializes the PHAR archive's metadata, which can trigger arbitrary object instantiation and execution of a gadget chain present in the application's class hierarchy — leading to RCE. The ftp:// and ssh2.sftp:// wrappers cause the server to initiate outbound connections to attacker-controlled hosts, enabling SSRF. The call chain is: IOFactory::load($filename) → IReader::load() → IReader::loadSpreadsheetFromFile() → File::assertFile() → is_file($filename) (GitHub Advisory).

Successful exploitation via the phar:// vector can result in arbitrary PHP code execution with the privileges of the web application process, granting full confidentiality, integrity, and availability impact on the affected server. The SSRF vectors (ftp://, ssh2.sftp://) allow attackers to probe and interact with internal network services not otherwise accessible from the internet, potentially enabling lateral movement or credential harvesting. Because PhpSpreadsheet underpins widely used Laravel and other PHP ecosystem packages (e.g., maatwebsite/excel, sonata-project/exporter), the blast radius extends to any application that passes user-controlled filenames to IOFactory::load() (GitHub Advisory).

A functional proof-of-concept exploit (PHP scripts make_phar.php and test.php) is publicly available in the GitHub Security Advisory, demonstrating both RCE via phar:// deserialization and SSRF via ftp://. The exploit requires no authentication and no user interaction, and operates over the network with low attack complexity. As of the time of reporting, there is no evidence of active in-the-wild exploitation, and the CVE is not listed in the CISA KEV catalog. The EPSS score is 0.001 (0.1%), reflecting low observed exploitation probability at this time (GitHub Advisory, Feedly).

1. Reconnaissance: Identify web applications that accept user-supplied filenames and pass them to PhpSpreadsheet's IOFactory::load() — common in file upload or import features built on Laravel (maatwebsite/excel) or similar PHP frameworks using affected versions.
2. Craft a malicious PHAR archive: Create a PHP script (make_phar.php) that embeds a gadget class with a __destruct() method executing a shell command (e.g., touch /tmp/poc.txt). Build the PHAR with phar.readonly=0 set in php.ini, then rename it to a plausible extension (e.g., exploit.xlsx):

   php -c php.ini make_phar.php

3. Upload or deliver the malicious file: Place exploit.xlsx on a path accessible to the target server, or host it on an attacker-controlled server.
4. Trigger PHAR deserialization (RCE): Supply the phar:// stream wrapper path as the filename argument to the vulnerable endpoint:

   php test.php phar://exploit.xlsx/test

   The is_file() check passes, PHAR metadata is deserialized, and the gadget's __destruct() executes the shell command.
5. Verify execution: Confirm RCE by checking for the artifact created by the payload:

   ls -lah /tmp/poc.txt

6. SSRF variant: To perform SSRF, listen on a port and supply an ftp:// wrapper URL:

   ncat -lvp 21
   php test.php ftp://127.0.0.1:21/test

   Observe the inbound connection, confirming the server initiates requests to attacker-specified hosts (GitHub Advisory).

• Network: Unexpected outbound FTP (port 21) or SSH (port 22) connections originating from the web application server process; connections to unusual external IPs from the PHP/web server process, particularly on ports 21 or 22.
• File System: Unexpected files created in world-writable directories (e.g., /tmp/) by the web server user; presence of .phar files or spreadsheet-extension files (.xlsx, .csv) containing PHP serialized objects in upload directories.
• Logs: Web server access logs showing file import/upload requests with filenames containing phar://, ftp://, or ssh2.sftp:// in parameters; PHP error logs referencing PHAR deserialization or stream wrapper errors from IOFactory or File::assertFile.
• Process: Unusual child processes spawned by the PHP-FPM or Apache/Nginx worker process (e.g., sh, bash, curl, wget) following a file load operation; unexpected files modified or created by the web application user account (GitHub Advisory).

Upgrade PhpSpreadsheet to a patched version corresponding to your current branch: 1.30.3, 2.1.15, 2.4.4, 3.10.4, or 5.6.0. If immediate patching is not possible, implement strict server-side input validation to reject any filename argument containing PHP stream wrapper schemes (e.g., block strings matching phar://, ftp://, ssh2.sftp://) before passing them to IOFactory::load(). Additionally, consider disabling unused PHP stream wrappers at the php.ini level and setting phar.readonly=1 to prevent PHAR deserialization. Avoid exposing file import functionality to unauthenticated users where possible (GitHub Advisory).

The vulnerability was reported by security researcher calligraf0 and published by PhpSpreadsheet maintainer oleibman via GitHub Security Advisories on April 28, 2026. Community discussion noted the broad downstream impact given PhpSpreadsheet's role as a dependency for popular packages like maatwebsite/excel (widely used in Laravel applications), amplifying the effective attack surface. The advisory was picked up by multiple threat intelligence aggregators including Vulners, VulDB, and OSV within days of publication (GitHub Advisory, Feedly).