{"id":"CVE-2026-108358","kind":"vulnerability","aliases":["CVE-2026-108358"],"related":[],"title":"PhpSpreadsheet: crafted XLSX can bypass XXE filter, read local files","description":"PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that accounts for NUL-byte interleaving but not ISO-2022 escape sequences in XLSX XML parts. The escape sequences prevent the scanner from matching the declaration, and XML charset normalization then removes the escape bytes before parsing, exposing a valid DOCTYPE and entity definitions. Processing an attacker-controlled XLSX can therefore cause entity-expansion denial of service on supported PHP versions and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.","summary":"A crafted XLSX file can hide an XML DOCTYPE from the library's scanner using ISO-2022 escape bytes, so the parser later sees it and expands entities. An attacker can cause a denial of service, and on PHP before 8.0 or with LIBXML_NOENT enabled, read local files or make server-side requests.","severity":"high","cvss":8.8,"epss":0.00385,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","phpspreadsheet","self-hosted"],"not_affected_if":["no-untrusted-xlsx-input","up-to-date-version"],"how_to_check":"Run: composer show phpoffice/phpspreadsheet and compare the version against the fixed releases.","fix":"Upgrade phpoffice/phpspreadsheet to 1.30.7, 2.1.19, 2.4.8, 3.10.8, or 5.10.0 (whichever matches your major line).\nIf you cannot upgrade, do not parse untrusted XLSX uploads.","status":"open","published_at":"2026-10-22T18:17:26+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-23T22:32:17+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:32:17Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade phpoffice/phpspreadsheet to 1.30.7, 2.1.19, 2.4.8, 3.10.8, or 5.10.0 (whichever matches your major line).\nIf you cannot upgrade, do not parse untrusted XLSX uploads.","reach":"internet","title":"PhpSpreadsheet: crafted XLSX can bypass XXE filter, read local files","impact":"high","summary":"A crafted XLSX file can hide an XML DOCTYPE from the library's scanner using ISO-2022 escape bytes, so the parser later sees it and expands entities. An attacker can cause a denial of service, and on PHP before 8.0 or with LIBXML_NOENT enabled, read local files or make server-side requests.","category":"package","who_cares":["php","phpspreadsheet","self-hosted"],"confidence":0.8,"needs_auth":"unknown","worst_case":"Server reads local files or makes internal requests after parsing a crafted XLSX.","analyst_note":"","how_to_check":"Run: composer show phpoffice/phpspreadsheet and compare the version against the fixed releases.\nunknown","needs_analyst":false,"not_affected_if":["no-untrusted-xlsx-input","up-to-date-version"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000555,"input_tokens":3172,"output_tokens":476,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-108358':13A,16A '-2022':39B,117C '-2026':12A,15A '1.30.7':92C,195C '2.1.19':93C,196C '2.4.8':94C,197C '3.10.8':95C,198C '5.10.0':97C,200C '8.0':63B,182C 'access':176C 'account':108C 'attack':52B,155C 'attacker-control':154C 'bypass':5A 'byte':41B,112C,142C 'caus':54B,160C 'charset':136C 'control':156C 'craft':2A,24B 'cve':11A,14A 'declar':133C 'definit':151C 'denial':56B,164C 'detect':105C 'doctyp':31B,104C,148C 'enabl':68B,188C 'entiti':50B,150C,162C 'entity-expans':161C 'escap':40B,118C,125C,141C 'expand':49B 'expans':163C 'expos':145C 'file':10A,26B,71B,89C,175C 'filter':7A 'fix':192C 'hide':28B 'host':22B 'interleav':113C 'iso':38B,116C 'issu':190C 'later':45B 'librari':34B,83C 'libxml':66B,185C 'local':9A,70B,174C 'make':73B 'match':131C 'noent':67B,186C 'normal':137C 'nul':111C 'nul-byt':110C 'packag':17B 'pars':144C 'parser':44B 'part':123C 'pattern':106C 'permit':173C 'php':18B,61B,82C,169C,180C 'phpspreadsheet':1A,19B,78C 'prevent':127C 'prior':90C 'process':152C 'pure':81C 'read':8A,69B,85C 'remov':139C 'request':77B 'scan':99C 'scanner':36B,129C 'see':46B 'self':21B 'self-host':20B 'sequenc':119C,126C 'server':75B 'server-sid':74B 'servic':58B,166C 'side':76B 'spreadsheet':88C 'src/phpspreadsheet/reader/security/xmlscanner.php':101C 'ssrf':178C 'support':168C 'therefor':159C 'use':37B,102C 'valid':147C 'version':170C,194C 'write':87C 'xlsx':3A,25B,121C,157C 'xml':30B,122C,135C 'xmlscanner':98C 'xxe':6A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T18:17:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108358","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108358","severity":null,"published_at":"2026-10-22T18:17:26+00:00","modified_at":"2026-10-23T22:16:53+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-108358","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108358","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}