CVE-2026-108358: PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that accounts for NUL-byte interleaving but not ISO-2022 escape sequences in XLSX XML parts. The escape sequences prevent the scanner from matching the declaration, and XML charset normalization then removes the escape bytes before parsing, exposing a valid DOCTYPE and entity definitions. Processing an attacker-controlled XLSX can therefore cause entity-expansion denial of service on supported PHP versions and can permit local file access or SSRF on PHP before 8.0 or when LIBXMLNOENT is enabled. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PhpSpreadsheetto a version that resolves this vulnerability.Fixed in 1.30.7 - Upgrade
Upgrade
PhpSpreadsheetto a version that resolves this vulnerability.Fixed in 2.1.19 - Upgrade
Upgrade
PhpSpreadsheetto a version that resolves this vulnerability.Fixed in 2.4.8 - Upgrade
Upgrade
PhpSpreadsheetto a version that resolves this vulnerability.Fixed in 3.10.8 - Upgrade
Upgrade
PhpSpreadsheetto a version that resolves this vulnerability.Fixed in 5.10.0
Event History
Frequently Asked Questions
Which applications are exposed to the most serious impacts?
Applications that use PhpSpreadsheet to process attacker-controlled XLSX files are exposed to entity-expansion denial of service on supported PHP versions. Local file access and SSRF are additionally possible on PHP versions before 8.0 or when LIBXML_NOENT is enabled.
What must an attacker provide to exploit this issue?
An attacker needs to supply an XLSX file that the application processes with an affected PhpSpreadsheet version. The XLSX XML parts can use ISO-2022 escape sequences to hide a DOCTYPE declaration from XmlScanner before XML charset normalization exposes it to the parser.
Are installations using a default XML-entity configuration affected?
Entity-expansion denial of service can occur on supported PHP versions when processing a malicious XLSX. The local-file-access and SSRF impacts require either PHP before 8.0 or LIBXML_NOENT to be enabled.
Which versions contain the fix?
The issue is fixed in PhpSpreadsheet versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0. Use the applicable fixed release for the version line deployed.