{"id":"CVE-2026-108359","kind":"vulnerability","aliases":["CVE-2026-108359"],"related":[],"title":"PhpSpreadsheet: crafted ODS file exhausts memory and crashes PHP worker","description":"PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Ods::processTableRow in src/PhpSpreadsheet/Reader/Ods.php accepts an unbounded table:number-rows-repeated attribute from an ODS table row. When the row contains a value, the reader materializes a cell for every repetition without checking the spreadsheet row limit, so a small attacker-controlled ODS file can consume substantial CPU and memory and terminate the PHP worker. Column repetition is separately bounded and is not part of this vulnerability. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.","summary":"A crafted ODS spreadsheet file with an unbounded row repeat count makes the PhpSpreadsheet reader create a cell for every repetition. An attacker who can get the server to read one small file can use up CPU and memory and terminate the PHP worker.","severity":"high","cvss":8.7,"epss":0.00407,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["file-upload","package","php","phpspreadsheet","self-hosted"],"not_affected_if":["no-ods-parsing","reads-xlsx-csv-only"],"how_to_check":"Run composer show phpoffice/phpspreadsheet and check whether the installed version is below 1.30.7, 2.1.19, 2.4.8, 3.10.8, or 5.10.0 for its branch.\nIf the app reads ODS uploads with PhpSpreadsheet, the exposure is real.","fix":"Upgrade phpoffice/phpspreadsheet to 1.30.7, 2.1.19, 2.4.8, 3.10.8, or 5.10.0, matching your major version.\nUntil then, reject .ods uploads or cap upload size and worker memory_limit.","status":"open","published_at":"2026-10-22T18:17:26+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-23T22:35:15+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:35:15Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade phpoffice/phpspreadsheet to 1.30.7, 2.1.19, 2.4.8, 3.10.8, or 5.10.0, matching your major version.\nUntil then, reject .ods uploads or cap upload size and worker memory_limit.","reach":"internet","title":"PhpSpreadsheet: crafted ODS file exhausts memory and crashes PHP worker","impact":"medium","summary":"A crafted ODS spreadsheet file with an unbounded row repeat count makes the PhpSpreadsheet reader create a cell for every repetition. An attacker who can get the server to read one small file can use up CPU and memory and terminate the PHP worker.","category":"package","who_cares":["php","phpspreadsheet","file-upload","self-hosted"],"confidence":0.8,"needs_auth":"unknown","worst_case":"Attacker crashes PHP workers via a small crafted file, causing denial of service.","analyst_note":"","how_to_check":"Run composer show phpoffice/phpspreadsheet and check whether the installed version is below 1.30.7, 2.1.19, 2.4.8, 3.10.8, or 5.10.0 for its branch.\nIf the app reads ODS uploads with PhpSpreadsheet, the exposure is real.","needs_analyst":false,"not_affected_if":["no-ods-parsing","reads-xlsx-csv-only"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000569,"input_tokens":3079,"output_tokens":523,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-108359':13A,16A '-2026':12A,15A '1.30.7':84C,165C '2.1.19':85C,166C '2.4.8':86C,167C '3.10.8':87C,168C '5.10.0':89C,170C 'accept':94C 'attack':48B,132C 'attacker-control':131C 'attribut':102C 'bound':151C 'cell':43B,118C 'check':123C 'column':147C 'consum':137C 'contain':111C 'control':133C 'count':36B 'cpu':62B,139C 'craft':2A,27B 'crash':8A 'creat':41B 'cve':11A,14A 'everi':45B,120C 'exhaust':5A 'file':4A,18B,30B,58B,81C,135C 'file-upload':17B 'fix':162C 'get':51B 'host':25B 'issu':160C 'librari':75C 'limit':127C 'make':37B 'materi':116C 'memori':6A,64B,141C 'number':99C 'number-rows-rep':98C 'od':3A,28B,90C,105C,134C 'one':56B 'packag':20B 'part':155C 'php':9A,21B,68B,74C,145C 'phpspreadsheet':1A,22B,39B,70C 'prior':82C 'processtablerow':91C 'pure':73C 'read':55B,77C 'reader':40B,115C 'repeat':35B,101C 'repetit':46B,121C,148C 'row':34B,100C,107C,110C,126C 'self':24B 'self-host':23B 'separ':150C 'server':53B 'small':57B,130C 'spreadsheet':29B,80C,125C 'src/phpspreadsheet/reader/ods.php':93C 'substanti':138C 'tabl':97C,106C 'termin':66B,143C 'unbound':33B,96C 'upload':19B 'use':60B 'valu':113C 'version':164C 'vulner':158C 'without':122C 'worker':10A,69B,146C 'write':79C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T18:17:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108359","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108359","severity":null,"published_at":"2026-10-22T18:17:26+00:00","modified_at":"2026-10-23T19:42:24+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-108359","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108359","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}