CVE-2026-108357

Name of the Vulnerable Software and Affected Versions PhpSpreadsheet versions 3.3.0 through 3.10.7 PhpSpreadsheet versions prior to 5.10.0

Description Processing attacker-controlled SpreadsheetML XML can lead to entity-expansion denial of service, local file access, or Server-Side Request Forgery (SSRF) on PHP versions before 8.0 or when LIBXML NOENT is enabled. The issue occurs because ReaderXml passes XML through XmlScanner::scan in the Xml::canRead and Xml::trySimpleXMLLoadStringPrivate functions, while Xml::unentity decodes numeric entities only after DOCTYPE pattern checks. A double-encoded less-than character can bypass these checks, allowing SimpleXML to receive an unchecked DOCTYPE and entity declaration.

Recommendations Update to version 3.10.8. Update to version 5.10.0.