Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-45034 — PoC exploit for PHPSpreadsheet's phar:// deserialization vulnerability, bypassing prohibitWrappers to achieve remote code execution on vulnerable PHP applications. | Kitploit
Tools/GitHubGitHub/sangsenimanwartefak/cve-2026-45034
Vulnerability AnalysisExploitationWeb Application ExploitationPayload Development
GitHubsangsenimanwartefak/cve-2026-45034

CVE-2026-45034

PoC exploit for PHPSpreadsheet's phar:// deserialization vulnerability, bypassing prohibitWrappers to achieve remote code execution on vulnerable PHP applications.

View Repository
23 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

🧨 PHPSpreadsheet Phar Deserialization Exploit

Bypass prohibitWrappers + Remote Code Execution (RCE) on phpoffice/phpspreadsheet

This repository provides a proof-of-concept (PoC) exploit for a critical vulnerability in the popular PHP library PHPSpreadsheet. The attack abuses the phar:// wrapper to trigger object deserialization, leading to bypass of security protections and even full remote code execution on vulnerable versions.

⚡ Vulnerability Overview

VersionStatusDescription
5.7.0 (latest 5.x)✅ BypassprohibitWrappers protection can be bypassed, but RCE gadget chain may be missing.
1.30.4 (latest 1.x)🔥 RCEFull gadget chain exists (PHP 7.4) – arbitrary code execution possible.

The vulnerability occurs when user-controlled input is passed to functions that accept a phar:// stream wrapper. By crafting a malicious PHAR archive containing a serialized gadget, an attacker can trigger __wakeup() and __destruct() calls, leading to file write or command execution.

🚀 Usage

1. Clone the repository

root@kitploit:~
git clone https://github.com/Cyber-DarkNay/CVE-2026-45034.git
cd CVE-2026-45034
Download Tool