CVE-2026-108357: PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored SpreadsheetML XML through XmlScanner::scan in Xml::canRead and Xml::trySimpleXMLLoadStringPrivate, while Xml::unentity decodes numeric entities only after each DOCTYPE pattern check. A double-encoded less-than character is reduced by the first callback to another encoded character and by the second callback to a literal less-than sign, so SimpleXML receives an unchecked DOCTYPE and entity declaration. Processing attacker-controlled SpreadsheetML XML can cause entity-expansion denial of service and can permit local file access or SSRF on PHP before 8.0 or when LIBXMLNOENT is enabled. This issue is fixed in versions 3.10.8 and 5.10.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PhpSpreadsheetto a version that resolves this vulnerability.Fixed in 3.10.8 - Upgrade
Upgrade
PhpSpreadsheetto a version that resolves this vulnerability.Fixed in 5.10.0
Event History
Frequently Asked Questions
Which deployments are exposed to file disclosure or SSRF rather than only denial of service?
Local file access or SSRF is possible on PHP versions before 8.0, or in environments where LIBXML_NOENT is enabled. Entity-expansion denial of service can result when attacker-controlled SpreadsheetML XML is processed.
What input must an attacker control to exploit this issue?
The attacker needs to supply SpreadsheetML XML that the application processes through PhpSpreadsheet's XML reader. The bypass uses a double-encoded less-than character so a DOCTYPE and entity declaration reach SimpleXML after the scanner's checks.
Which versions should be remediated?
Upgrade to PhpSpreadsheet 3.10.8 or 5.10.0. The affected ranges are from 3.3.0 through 3.10.8 and version 5.10.0 as stated in the advisory data.