https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T12:54:05.060794+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/bdu:2025-11115 bdu:2025-11115 2026-09-29T12:54:05.063473+00:00 bdu:2025-11115 https://vulnerability.circl.lu/vuln/cve-2025-54370 CVE-2025-54370 — PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser 2026-09-29T12:54:05.063519+00:00

Affected: PHPOffice PhpSpreadsheet

PhpOffice/PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to versions 1.30.0, 2.1.12, 2.4.0, 3.10.0, and 5.0.0, SSRF can occur when a processed HTML document is read and displayed in the browser. The vulnerability lies in the setPath method of the PhpOffice\PhpSpreadsheet\Worksheet\Drawing class, where a crafted string from the user is passed to the HTML reader. This issue has been patched in versions 1.30.0, 2.1.12, 2.4.0, 3.10.0, and 5.0.0.