Live › vulnerability › CVE-2026-108358
Go to dashboardA crafted XLSX file can hide an XML DOCTYPE from the library's scanner using ISO-2022 escape bytes, so the parser later sees it and expands entities. An attacker can cause a denial of service, and on PHP before 8.0 or with LIBXML_NOENT enabled, read local files or make server-side requests.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Run: composer show phpoffice/phpspreadsheet and compare the version against the fixed releases.
1.30.7, 2.1.19, 2.4.8, 3.10.8, or 5.10.0 (whichever matches your major line)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that accounts for NUL-byte interleaving but not ISO-2022 escape sequences in XLSX XML parts. The escape sequences prevent the scanner from matching the declaration, and XML charset normalization then removes the escape bytes before parsing, exposing a valid DOCTYPE and entity definitions. Processing an attacker-controlled XLSX can therefore cause entity-expansion denial of service on supported PHP versions and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-108358")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.