IT SBIT Services
Schneeberger
DEEN
CVE tracker

PhpSpreadsheet: XML entity bypass allows XXE and denial of service

CVE-2026-108357High 8.8

← All vulnerabilities

Summary

PhpSpreadsheet, a PHP library for reading and writing spreadsheet files, can be bypassed in its XML security filter when reading SpreadsheetML files. A double-encoded less-than character lets an unchecked DOCTYPE and entity declaration reach the XML parser. An attacker who can supply a crafted spreadsheet can cause entity-expansion denial of service and, on PHP below 8.0 or with LIBXML_NOENT enabled, may read local files or perform server-side request forgery.

Affected

  • PhpSpreadsheet 3.3.0 up to but not including 3.10.8
  • PhpSpreadsheet 4.0.0 up to but not including 5.10.0
  • Note: the CNA record and the research notes list different ranges for some sources; verify the installed version with composer show.

Fixed in

  • 3.10.8
  • 5.10.0

Workaround

  • Unknown. No vendor-documented workaround found; the vendor documents upgrading as the remedy.

Exploitation

  • No confirmed exploitation found at the time of research.
  • CISA SSVC: exploitation none, automatable yes, technical impact partial.
  • No public proof of concept found.

Our recommendation

  • Check whether any application uses PhpSpreadsheet (often as a Composer dependency) and which version is installed.
  • Upgrade to 3.10.8 or 5.10.0. Note that 5.10.0 requires PHP 8.2 or later; plan a PHP upgrade if the host runs PHP 8.1 or older.
  • If an upgrade is blocked, stop passing untrusted spreadsheet files to the Xml reader and run parsing in an isolated worker with restricted network access.
  • Prioritise applications with public upload forms and check whether they are reachable without login.
  • Also check older PhpSpreadsheet branches, as a related CVE-2026-108358 may affect them.
  • Record the CVSS discrepancy (8.8 v4.0 versus 9.3 v3.1 at GitLab/GHSA and 5.5 at VulDB) for prioritisation.
  • Confirm the upgrade in a test environment first.
  • Advisory dates differ between sources; the fixed versions are consistent across them.
  • Product-specific Swiss exposure is unknown.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:55.

Original description (NVD)

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored SpreadsheetML XML through XmlScanner::scan in Xml::canRead and Xml::trySimpleXMLLoadStringPrivate, while Xml::unentity decodes numeric entities only after each DOCTYPE pattern check. A double-encoded less-than character is reduced by the first callback to another encoded character and by the second callback to a literal less-than sign, so SimpleXML receives an unchecked DOCTYPE and entity declaration. Processing attacker-controlled SpreadsheetML XML can cause entity-expansion denial of service and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 3.10.8 and 5.10.0.

NVD references (5)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed