CVE-2026-45034: PhpSpreadsheet: File::prohibitWrappers bypass

Synopsis

This is an authentication bypass and phar deserialization vulnerability in PHPOffice/PhpSpreadsheet affecting all versions before 1.30.5. The flaw is reachable over the network with no authentication required: a crafted filename using three or more slashes after the phar:// scheme (for example, phar:///path/file.phar/inner) causes the File::prohibitWrappers helper to silently skip its validation, allowing PHP's stream layer to open the phar file anyway. On PHP 7.x, this gives an unauthenticated remote attacker full remote code execution by triggering automatic phar metadata deserialization; on PHP 8.x the immediate impact is an arbitrary file read via the phar wrapper, with RCE possible if the application calls Phar::getMetadata on the returned data. HarborGuard tracks this advisory and will make a patched-image rebuild available once fix version 1.30.5 is confirmed publishable upstream. NOTE: The description states a fix exists at 1.30.5, so a patched-image rebuild at 1.30.5 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable IOFactory::load call must be reachable over the network, meaning an attacker can supply a crafted filename to the application from a remote connection.

• AuthenticationNot required

  No credentials or session are needed; the CVSS vector specifies PR:N, so any unauthenticated request that reaches the file-load code path is sufficient.

• Victim interactionNot required

  No user action is required on the target side; the CVSS vector specifies UI:N, so the exploit executes without social engineering or user clicks.

• Attack complexityDetail

  The base exploit is reliable and condition-free (AC:L), though the CVSS vector notes an attack requirement of AT:P, meaning the attacker must be able to control the filename argument passed to IOFactory::load, which depends on how the application exposes that input.

Blast Radius

• On PHP 7.x, a successful attacker executes arbitrary code on the host running PhpSpreadsheet by triggering deserialization of attacker-controlled phar metadata, invoking __wakeup and __destruct magic methods on arbitrary objects.
• On PHP 8.x without Phar::getMetadata calls, a successful attacker reads arbitrary files accessible to the PHP process by redirecting file operations through the phar wrapper.
• If the application or any downstream library calls Phar::getMetadata on PHP 8.x, the attacker regains full remote code execution through the same deserialization chain.
• In all cases the CVSS v4.0 impact tokens indicate high confidentiality, integrity, and availability impact: the attacker reads sensitive data, modifies or deletes files and application state, and disrupts service availability on the affected host.