CVE-2026-108358

Name of the Vulnerable Software and Affected Versions PhpSpreadsheet versions prior to 1.30.7 PhpSpreadsheet versions prior to 2.1.19 PhpSpreadsheet versions prior to 2.4.8 PhpSpreadsheet versions prior to 3.10.8 PhpSpreadsheet versions prior to 5.10.0

Description The XmlScanner::scan() function in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that fails to account for ISO-2022 escape sequences in XLSX XML parts. These escape sequences bypass the scanner's detection; subsequently, XML charset normalization removes the escape bytes before parsing, which exposes a valid DOCTYPE and entity definitions. Processing a malicious XLSX file can lead to an entity-expansion denial of service. Additionally, on PHP versions prior to 8.0 or when LIBXML NOENT is enabled, this can allow local file access or Server-Side Request Forgery (SSRF), where the server is tricked into making requests to an unintended location.

Recommendations Update to version 1.30.7 or later. Update to version 2.1.19 or later. Update to version 2.4.8 or later. Update to version 3.10.8 or later. Update to version 5.10.0 or later.