Denial of Service in PhpSpreadsheet Library by PhpOffice
CVE-2026-108358
8.8HIGH
What is CVE-2026-108358?
The PhpSpreadsheet library, used for reading and writing spreadsheet files in PHP, contains a vulnerability that arises from the way the XmlScanner class detects DOCTYPE declarations. Due to unaddressed ISO-2022 escape sequences, the library is susceptible to entity expansion attacks when processing malicious XLSX files. This could lead to a denial of service through entity expansion or local file access under certain configurations. The issue has been addressed in PHP versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0. Users are strongly advised to upgrade to these versions to mitigate potential risks.
Affected Version(s)
PhpSpreadsheet < 1.30.7 < 1.30.7
PhpSpreadsheet >= 2.0.0, < 2.1.19 < 2.0.0, 2.1.19
PhpSpreadsheet >= 2.2.0, < 2.4.8 < 2.2.0, 2.4.8