PhpSpreadsheet’s XmlScanner allows double-encoded less‑than characters to bypass the entity scan that occurs after a DOCTYPE check. The unentity() routine decodes numeric entities only after the DOCTYPE pattern is verified, so a double‑encoded character is decoded twice: first into another encoded form and then into a literal less‑than sign. This results in an unchecked DOCTYPE parsed by SimpleXML, permitting a malicious SpreadsheetML document to declare external entities. The consequence is a classic XML External Entity (XXE) vulnerability that can lead to file disclosure, server‑side request forgery (SSRF) on PHP when LIBXML_NOENT is enabled, and an entity‑expansion denial‑of‑service attack. The underlying weakness is a race condition (TOCTOU) combined with improper handling of entity decoding, corresponding to CWE‑611 and CWE‑776.

The library PHPOffice:PhpSpreadsheet is affected in every release from 3.3.0 through 3.10.8 and in 5.10.0. Versions prior to 3.10.8 and 5.10.0 are vulnerable. The issue has been fixed as of the 3.10.8 and 5.10.0 releases, so any installation using an older version should be upgraded. GitHub commits 89f455c and 980b5c and the 3.10.8 and 5.10.0 releases contain the security fix.

The CVSS score of 8.8 marks this as a high‑severity vulnerability. The EPSS score is not available, but the absence of current exploitation data does not diminish the risk because the weakness permits local file access or SSRF and can cause a denial of service. Although it is not listed in the CISA KEV catalog, the potential impact on confidentiality, integrity, and availability is significant for any system that processes untrusted spreadsheet files through PhpSpreadsheet. The likely attack vector involves uploading or loading a malicious SpreadsheetML file from an attacker into an application that uses this library. Successful exploitation requires the library to parse the file; therefore, the risk is highest when the code path is exposed to untrusted input.