Log in Start free

Vulnerability · Published Oct 22, 2026 · Assigned by GitHub_M

CVE-2026-108357PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service

High 8.8

In plain English

A high-severity XML external entity in PhpSpreadsheet from PHPOffice. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.8High
Exploit odds (30 days)0.5%top 59.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored SpreadsheetML XML through XmlScanner::scan in Xml::canRead and Xml::trySimpleXMLLoadStringPrivate, while Xml::unentity decodes numeric entities only after each DOCTYPE pattern check. A double-encoded less-than character is reduced by the first callback to another encoded character and by the second callback to a literal less-than sign, so SimpleXML receives an unchecked DOCTYPE and entity declaration. Processing attacker-controlled SpreadsheetML XML can cause entity-expansion denial of service and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 3.10.8 and 5.10.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistphpoffice/phpspreadsheet5.10.0GHSA-rxj4-h86g-25gc
Packagistphpoffice/phpspreadsheet3.10.8GHSA-rxj4-h86g-25gc

Affected products (as reported)

VendorProductVersions
PHPOffice PhpSpreadsheet >= 3.3.0, < 3.10.8>= 4.0.0, < 5.10.0

Weakness: CWE-611, CWE-776 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:L/SI:N/SA:N

References