StackRadar

CVE-2026-59933

High

Advisory

Published 23 Jul 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.004
31st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
20
of 17,781 indexed, latest versions
Container images
15
deployed by those charts
Fix available
1 of 1
affected package

PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion

Carried by container images the latest versions of 20 of 17,781 indexed charts deploy, on 15 images.

Affected packageAffected versionsFixed inImages
phpoffice/phpspreadsheetcomposer1.18.0, 1.19.0, 1.21.0, 1.23.0+8 more1.30.6, 5.8.115
OSV records
GHSA-xh5m-36r6-47m3

Charts affected

20 by stars
ChartLatestAffected imagesRadar Score
snipeitt3n3.4.11 of 2See more

snipeit t3n 3.4.1

1 of the 2 container images this version deploys carry CVE-2026-59933.

Container imageDigestPackageFixed in
snipe/snipe-it:v6.0.1455fb7636a98c
phpoffice/phpspreadsheet@1.24.1
1.30.6

Open the chart page →

18,509
mauticone-acre-fundVerified publisher0.1.71 of 3See more

mautic one-acre-fund 0.1.7

1 of the 3 container images this version deploys carry CVE-2026-59933.

Container imageDigestPackageFixed in
mautic/mautic:v4-apache94ea4acf4049
phpoffice/phpspreadsheet@1.23.0
1.30.6

Open the chart page →

2,667
brpservicebrpservice1.1.01 of 4See more

brpservice brpservice 1.1.0

1 of the 4 container images this version deploys carry CVE-2026-59933.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/brpservice-php:latestc17f1ba17d36
phpoffice/phpspreadsheet@1.18.0
1.30.6

Open the chart page →

7,830
commonground-gatewaycommonground-gateway1.5.41 of 7See more

commonground-gateway commonground-gateway 1.5.4

1 of the 7 container images this version deploys carry CVE-2026-59933.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/commonground-gateway-php:latest947882bf2c37
phpoffice/phpspreadsheet@1.29.0
1.30.6

Open the chart page →

9,724
akauntingf3k-techVerified publisher1.3121.01 of 4See more

akaunting f3k-tech 1.3121.0

1 of the 4 container images this version deploys carry CVE-2026-59933.

Container imageDigestPackageFixed in
akaunting/akaunting:3.1.21-fpm-alpine-nginxe7d5c245b1a0
phpoffice/phpspreadsheet@1.30.1
1.30.6

Open the chart page →

4,333
glpikitsune-itopsVerified publisher1.0.71 of 3See more

glpi kitsune-itops 1.0.7

1 of the 3 container images this version deploys carry CVE-2026-59933.

Container imageDigestPackageFixed in
glpi/glpi:latest4b681082a79e
phpoffice/phpspreadsheet@5.7.0
5.8.1

Open the chart page →

4,802
opencatalogiopencatalogi1.0.61 of 8See more

opencatalogi opencatalogi 1.0.6

1 of the 8 container images this version deploys carry CVE-2026-59933.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/commonground-gateway-php:latest947882bf2c37
phpoffice/phpspreadsheet@1.29.0
1.30.6

Open the chart page →

14,838
espocrmtwenty20-helm-chartsVerified publisher2.0.51 of 2See more

espocrm twenty20-helm-charts 2.0.5

1 of the 2 container images this version deploys carry CVE-2026-59933.

Container imageDigestPackageFixed in
espocrm/espocrm:10.0.8-fpm-alpine4bd92daf5f0c
phpoffice/phpspreadsheet@5.7.0
5.8.1

Open the chart page →

493
commonground-gatewaycommonground-gateway-frontend0.1.51 of 4See more

commonground-gateway commonground-gateway-frontend 0.1.5

1 of the 4 container images this version deploys carry CVE-2026-59933.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/commonground-gateway-php:latest947882bf2c37
phpoffice/phpspreadsheet@1.29.0
1.30.6

Open the chart page →

2,825
cspconsolecspconsole1.3.111 of 5See more

cspconsole cspconsole 1.3.11

1 of the 5 container images this version deploys carry CVE-2026-59933.

Container imageDigestPackageFixed in
cspconsole/csp-control-center:1.0.1046dda4a31bd6
phpoffice/phpspreadsheet@1.30.4
1.30.6

Open the chart page →

12,274
equizequiz0.0.11 of 3See more

equiz equiz 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-59933.

Container imageDigestPackageFixed in
yzhou442/equiz:latesta3f7ca69e28d
phpoffice/phpspreadsheet@1.21.0
1.30.6

Open the chart page →

7,541
equizequiz-chart0.0.11 of 3See more

equiz equiz-chart 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-59933.

Container imageDigestPackageFixed in
yzhou442/equiz:latesta3f7ca69e28d
phpoffice/phpspreadsheet@1.21.0
1.30.6

Open the chart page →

7,541
espocrmespocrmVerified publisher1.0.11 of 2See more

espocrm espocrm 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-59933.

Container imageDigestPackageFixed in
espocrm/espocrm:9.3.101b5a24504ed9
phpoffice/phpspreadsheet@5.3.0
5.8.1

Open the chart page →

6,431
anonaddygeek-cookbookVerified publisher6.0.01 of 1See more

anonaddy geek-cookbook 6.0.0

1 of the 1 container images this version deploys carry CVE-2026-59933.

Container imageDigestPackageFixed in
anonaddy/anonaddy:0.12.3957a95565166
phpoffice/phpspreadsheet@1.24.0
1.30.6

Open the chart page →

4,788
openemrgeek-cookbookVerified publisher5.2.01 of 1See more

openemr geek-cookbook 5.2.0

1 of the 1 container images this version deploys carry CVE-2026-59933.

Container imageDigestPackageFixed in
openemr/openemr:6.1.089eaa6d9a4e3
phpoffice/phpspreadsheet@1.21.0
1.30.6

Open the chart page →

8,392
mauticmautic-chartVerified publisher1.0.21 of 3See more

mautic mautic-chart 1.0.2

1 of the 3 container images this version deploys carry CVE-2026-59933.

Container imageDigestPackageFixed in
mautic/mautic:7-apacheeb8cc73d97e1
phpoffice/phpspreadsheet@5.7.0
5.8.1

Open the chart page →

8,303
fossologymidokura-communityVerified publisher0.2.21 of 2See more

fossology midokura-community 0.2.2

1 of the 2 container images this version deploys carry CVE-2026-59933.

Container imageDigestPackageFixed in
fossology/fossology:4.2.18bd1f22ba7bb
phpoffice/phpspreadsheet@1.19.0
1.30.6

Open the chart page →

3,294
akauntingnas-helm-chartsVerified publisher1.0.31 of 2See more

akaunting nas-helm-charts 1.0.3

1 of the 2 container images this version deploys carry CVE-2026-59933.

Container imageDigestPackageFixed in
akaunting/akaunting:3.0.1552811b36ec3a
phpoffice/phpspreadsheet@1.28.0
1.30.6

Open the chart page →

12,813
commonground-gatewayopencatalogi1.5.31 of 7See more

commonground-gateway opencatalogi 1.5.3

1 of the 7 container images this version deploys carry CVE-2026-59933.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/commonground-gateway-php:latest947882bf2c37
phpoffice/phpspreadsheet@1.29.0
1.30.6

Open the chart page →

9,724
commonground-gatewayskeleton-pip0.1.71 of 5See more

commonground-gateway skeleton-pip 0.1.7

1 of the 5 container images this version deploys carry CVE-2026-59933.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/commonground-gateway-php:latest947882bf2c37
phpoffice/phpspreadsheet@1.29.0
1.30.6

Open the chart page →

2,825

Container images carrying it

15 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/conductionnl/commonground-gateway-php:latest947882bf2c37
phpoffice/phpspreadsheet@1.29.0
1.30.6
5
yzhou442/equiz:latesta3f7ca69e28d
phpoffice/phpspreadsheet@1.21.0
1.30.6
2
akaunting/akaunting:3.0.1552811b36ec3a
phpoffice/phpspreadsheet@1.28.0
1.30.6
1
akaunting/akaunting:3.1.21-fpm-alpine-nginxe7d5c245b1a0
phpoffice/phpspreadsheet@1.30.1
1.30.6
1
anonaddy/anonaddy:0.12.3957a95565166
phpoffice/phpspreadsheet@1.24.0
1.30.6
1
cspconsole/csp-control-center:1.0.1046dda4a31bd6
phpoffice/phpspreadsheet@1.30.4
1.30.6
1
espocrm/espocrm:9.3.101b5a24504ed9
phpoffice/phpspreadsheet@5.3.0
5.8.1
1
espocrm/espocrm:10.0.8-fpm-alpine4bd92daf5f0c
phpoffice/phpspreadsheet@5.7.0
5.8.1
1
fossology/fossology:4.2.18bd1f22ba7bb
phpoffice/phpspreadsheet@1.19.0
1.30.6
1
glpi/glpi:latest4b681082a79e
phpoffice/phpspreadsheet@5.7.0
5.8.1
1
mautic/mautic:v4-apache94ea4acf4049
phpoffice/phpspreadsheet@1.23.0
1.30.6
1
mautic/mautic:7-apacheeb8cc73d97e1
phpoffice/phpspreadsheet@5.7.0
5.8.1
1
openemr/openemr:6.1.089eaa6d9a4e3
phpoffice/phpspreadsheet@1.21.0
1.30.6
1
snipe/snipe-it:v6.0.1455fb7636a98c
phpoffice/phpspreadsheet@1.24.1
1.30.6
1
ghcr.io/conductionnl/brpservice-php:latestc17f1ba17d36
phpoffice/phpspreadsheet@1.18.0
1.30.6
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.