Live › vulnerability › CVE-2026-108357
Go to dashboardPhpSpreadsheet's SpreadsheetML XML reader decodes numeric entities after its DOCTYPE safety check, so a double-encoded less-than sign smuggles an unchecked entity declaration into the parser. An attacker who supplies a crafted XML spreadsheet can cause denial of service through entity expansion, and can read local files or make server-side requests on PHP before 8.0 or when LIBXML_NOENT is enabled.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
composer show phpoffice/phpspreadsheet and check the installed version3.3.0 to before 3.10.8, or 5.10.0 with the flaw present, you are exposed3.10.8 (3.x line) or 5.10.0 (5.x line)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored SpreadsheetML XML through XmlScanner::scan in Xml::canRead and Xml::trySimpleXMLLoadStringPrivate, while Xml::unentity decodes numeric entities only after each DOCTYPE pattern check. A double-encoded less-than character is reduced by the first callback to another encoded character and by the second callback to a literal less-than sign, so SimpleXML receives an unchecked DOCTYPE and entity declaration. Processing attacker-controlled SpreadsheetML XML can cause entity-expansion denial of service and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 3.10.8 and 5.10.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-108357")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.