---
id: "CVE-2026-108359"
kind: "vulnerability"
aliases: ["CVE-2026-108359"]
title: "PhpSpreadsheet: crafted ODS file exhausts memory and crashes PHP worker"
severity: "high"
cvss: 8.7
epss: 0.00407
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["file-upload", "package", "php", "phpspreadsheet", "self-hosted"]
not_affected_if: ["no-ods-parsing", "reads-xlsx-csv-only"]
published_at: "2026-10-22T18:17:26+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108359", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-108359", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# PhpSpreadsheet: crafted ODS file exhausts memory and crashes PHP worker

A crafted ODS spreadsheet file with an unbounded row repeat count makes the PhpSpreadsheet reader create a cell for every repetition. An attacker who can get the server to read one small file can use up CPU and memory and terminate the PHP worker.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Run composer show phpoffice/phpspreadsheet and check whether the installed version is below 1.30.7, 2.1.19, 2.4.8, 3.10.8, or 5.10.0 for its branch.
If the app reads ODS uploads with PhpSpreadsheet, the exposure is real.

## Fix

Upgrade phpoffice/phpspreadsheet to 1.30.7, 2.1.19, 2.4.8, 3.10.8, or 5.10.0, matching your major version.
Until then, reject .ods uploads or cap upload size and worker memory_limit.

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-108359
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-108359

## From the sources

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Ods::processTableRow in src/PhpSpreadsheet/Reader/Ods.php accepts an unbounded table:number-rows-repeated attribute from an ODS table row. When the row contains a value, the reader materializes a cell for every repetition without checking the spreadsheet row limit, so a small attacker-controlled ODS file can consume substantial CPU and memory and terminate the PHP worker. Column repetition is separately bounded and is not part of this vulnerability. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_