Vulnerability · Published Oct 22, 2026 · Assigned by GitHub_M
CVE-2026-108358PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service
High 8.8
In plain English
A high-severity XML external entity in PhpSpreadsheet from PHPOffice. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that accounts for NUL-byte interleaving but not ISO-2022 escape sequences in XLSX XML parts. The escape sequences prevent the scanner from matching the declaration, and XML charset normalization then removes the escape bytes before parsing, exposing a valid DOCTYPE and entity definitions. Processing an attacker-controlled XLSX can therefore cause entity-expansion denial of service on supported PHP versions and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | phpoffice/phpspreadsheet | 5.10.0 | GHSA-3x94-m842-937c |
| Packagist | phpoffice/phpspreadsheet | 3.10.8 | GHSA-3x94-m842-937c |
| Packagist | phpoffice/phpspreadsheet | 2.4.8 | GHSA-3x94-m842-937c |
| Packagist | phpoffice/phpspreadsheet | 2.1.19 | GHSA-3x94-m842-937c |
| Packagist | phpoffice/phpspreadsheet | 1.30.7 | GHSA-3x94-m842-937c |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PHPOffice | PhpSpreadsheet | < 1.30.7>= 2.0.0, < 2.1.19>= 2.2.0, < 2.4.8>= 3.3.0, < 3.10.8>= 4.0.0, < 5.10.0 |
Weakness: CWE-611, CWE-776 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:L/SI:N/SA:N
References
- https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-3x94-m842-937c x_refsource_CONFIRM
- https://github.com/PHPOffice/PhpSpreadsheet/commit/299993894dce37aa3b64aa23e9a3f4bb77ab0e66 x_refsource_MISC
- https://github.com/PHPOffice/PhpSpreadsheet/commit/89f455c133e1a7e2d4abfadc43ce29eb7450d781 x_refsource_MISC
- https://github.com/PHPOffice/PhpSpreadsheet/commit/980b5c294493856f1a25754f1e8a1d2185b93738 x_refsource_MISC
- https://github.com/PHPOffice/PhpSpreadsheet/commit/9a0b48622ebfe93fa48cb9bc09ce57303bb07af9 x_refsource_MISC
- https://github.com/PHPOffice/PhpSpreadsheet/commit/da13f40e8760d599b0e8a296017d4b028b20e86c x_refsource_MISC
- https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.7 x_refsource_MISC
- https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.19 x_refsource_MISC
- https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.8 x_refsource_MISC
- https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.8 x_refsource_MISC
- https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.10.0 x_refsource_MISC