HIGH
PHPOffice
CVE published 2026-07-28
CVE-2026-59932
PhpSpreadsheet, a pure PHP library for reading and writing spreadsheet files, has a vulnerability in versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5. The Gnumeric reader reads attacker-supplied .gnumeric files into memory and, when the file starts with gzip magic bytes, calls gzdecode() on the full compressed conten [truncated]