PhpSpreadsheet: XML external entity injection via XLSX scanner bypass
Summary
PhpSpreadsheet, a PHP library for reading and writing spreadsheet files, fails to detect DOCTYPE declarations in XLSX XML parts that are hidden with ISO-2022 escape sequences. An attacker who supplies a crafted XLSX file can trigger entity-expansion denial of service on supported PHP versions. On PHP before 8.0 or when LIBXML_NOENT is enabled, the attacker can additionally read local files or perform server-side request forgery. The attack requires that an application processes attacker-controlled XLSX files.
Affected
- PhpSpreadsheet before 1.30.7
- PhpSpreadsheet 2.0.0 before 2.1.19
- PhpSpreadsheet 2.2.0 before 2.4.8
- PhpSpreadsheet 3.3.0 before 3.10.8
- PhpSpreadsheet 4.0.0 before 5.10.0
Fixed in
- 1.30.7
- 2.1.19
- 2.4.8
- 3.10.8
- 5.10.0 (recommended)
Workaround
No workaround documented by the vendor. Until patching is possible, stop accepting untrusted XLSX uploads or parse them in an isolated worker with restricted file and network access.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact partial
- No public exploitation reported in the sources reviewed
- The vendor advisory describes the bypass mechanism publicly; no public proof of concept was found
Our recommendation
- Identify all installations of phpoffice/phpspreadsheet, including copies pulled in by other packages (composer.lock, vendor directories)
- Upgrade to a fixed version, preferably 5.10.0
- Prioritise internet-facing applications that accept XLSX uploads
- Check whether PHP is older than 8.0 or LIBXML_NOENT is set, as this enables file access and SSRF
- Monitor NVD and CISA KEV for status changes
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-3x94-m842-937c github.com
- PhpSpreadsheet release 5.10.0 github.com
- PhpSpreadsheet release 1.30.7 github.com
- PhpSpreadsheet release 2.1.19 github.com
- PhpSpreadsheet release 2.4.8 github.com
- PhpSpreadsheet release 3.10.8 github.com
- GitLab Advisory Database entry CVE-2026-108358 advisories.gitlab.com
- Tenable CVE-2026-108358 www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:55.
Original description (NVD)
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that accounts for NUL-byte interleaving but not ISO-2022 escape sequences in XLSX XML parts. The escape sequences prevent the scanner from matching the declaration, and XML charset normalization then removes the escape bytes before parsing, exposing a valid DOCTYPE and entity definitions. Processing an attacker-controlled XLSX can therefore cause entity-expansion denial of service on supported PHP versions and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.
NVD references (11)
- https://github.com/PHPOffice/PhpSpreadsheet/commit/299993894dce37aa3b64aa23e9a3f4bb77ab0e66
- https://github.com/PHPOffice/PhpSpreadsheet/commit/89f455c133e1a7e2d4abfadc43ce29eb7450d781
- https://github.com/PHPOffice/PhpSpreadsheet/commit/980b5c294493856f1a25754f1e8a1d2185b93738
- https://github.com/PHPOffice/PhpSpreadsheet/commit/9a0b48622ebfe93fa48cb9bc09ce57303bb07af9
- https://github.com/PHPOffice/PhpSpreadsheet/commit/da13f40e8760d599b0e8a296017d4b028b20e86c
- https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.7
- https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.19
- https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.8
- https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.8
- https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.10.0
- https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-3x94-m842-937c
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.