SSRF and RCE via PHP wrapper in PhpSpreadsheet IOFactory::load (CVE-2026-34084)

PhpSpreadsheet's `File::assertFile` helper uses PHP's `is_file()` to validate filenames passed to `IOFactory::load`, but `is_file()` processes PHP stream wrappers such as `phar://`, `ftp://`, and `ssh2.sftp://`. When a user-controlled filename is passed to `IOFactory::load`, an attacker can supply a wrapper-prefixed path to trigger Server-Side Request Forgery at minimum, or Remote Code Execution via phar deserialization gadget chains when suitable classes are present in the deployment. Affected versions: - >= 4.0.0, <= 5.5.0 - >= 3.3.0, <= 3.10.3 - >= 2.2.0, <= 2.4.3 - >= 2.0.0, <= 2.1.14 - <= 1.30.2 We recommend updating to: 5.6.0, 3.10.4, 2.4.4, 2.1.15, 1.30.3. CVSS 9.2 · our assessment: act_now Reference: https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-q4q6-r8wh-5cgh Details: https://vuln.today/cve/CVE-2026-34084