XML Parsing Vulnerability in PhpSpreadsheet Affects Multiple Versions
CVE-2026-108357
8.8HIGH
What is CVE-2026-108357?
A vulnerability exists in PhpSpreadsheet's XML processing that can lead to entity-expansion denial of service. The affected versions process untrusted SpreadsheetML XML inputs improperly, allowing attackers to exploit unchecked DOCTYPE and entity declarations. This can cause local file access or server-side request forgery (SSRF) if PHP is below version 8.0 or if LIBXML_NOENT is enabled. Critical updates are available in versions 3.10.8 and 5.10.0 to mitigate this risk.
Affected Version(s)
PhpSpreadsheet >= 3.3.0, < 3.10.8 < 3.3.0, 3.10.8
PhpSpreadsheet >= 4.0.0, < 5.10.0 < 4.0.0, 5.10.0