Description
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that accounts for NUL-byte interleaving but not ISO-2022 escape sequences in XLSX XML parts. The escape sequences prevent the scanner from matching the declaration, and XML charset normalization then removes the escape bytes before parsing, exposing a valid DOCTYPE and entity definitions. Processing an attacker-controlled XLSX can therefore cause entity-expansion denial of service on supported PHP versions and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.
Published: 2026-10-22
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service and Local File Access
Action: Immediate Patch
AI Analysis

Impact

XmlScanner::scan in PhpSpreadsheet fails to detect DOCTYPE declarations when ISO‑2022 escape sequences are present in XLSX XML parts. The scan bypass allows XML entities to be expanded, triggering denial of service attacks, and when PHP versions before 8.0 run or when LIBXML_NOENT is enabled, it can also enable local file inclusion or server‑side request forgery via entity references. This flaw is a classic XML External Entity vulnerability (CWE‑611) exacerbated by improper handling of escape sequences (CWE‑776).

Affected Systems

The vulnerability affects the PHPOffice PhpSpreadsheet library in versions older than 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0. Only releases equal to or newer than these addresses the issue.

Risk and Exploitability

With a CVSS score of 8.8 the flaw is considered high severity. The EPSS score is not available, so the exact likelihood of exploitation cannot be quantified, but the flaw is not listed in CISA KEV, indicating no confirmed widespread exploitation. Attackers can trigger the vulnerability by supplying a crafted XLSX file to any application that imports spreadsheets using the affected PhpSpreadsheet library. Successful exploitation could lead to service disruption through excessive memory consumption or, on vulnerable PHP configurations, unauthorized file access or external resource requests.

Generated by OpenCVE AI on October 22, 2026 at 18:33 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the PhpSpreadsheet library to the latest fixed releases (>=1.30.7, >=2.1.19, >=2.4.8, >=3.10.8, >=5.10.0) as indicated in the advisory links.
  • If immediate upgrade is not feasible, remove the LIBXML_NOENT option or set libxml_set_external_entity_loader to false to prevent entity expansion during XML parsing.
  • For PHP versions older than 8.0, ensure that external entity loading is disabled by calling libxml_use_internal_errors(true) and libxml_disable_entity_loader(true) before parsing.

Generated by OpenCVE AI on October 22, 2026 at 18:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-3x94-m842-937c PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service
History

Fri, 23 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Phpoffice
Phpoffice phpspreadsheet
Vendors & Products Phpoffice
Phpoffice phpspreadsheet

Thu, 22 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Description PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that accounts for NUL-byte interleaving but not ISO-2022 escape sequences in XLSX XML parts. The escape sequences prevent the scanner from matching the declaration, and XML charset normalization then removes the escape bytes before parsing, exposing a valid DOCTYPE and entity definitions. Processing an attacker-controlled XLSX can therefore cause entity-expansion denial of service on supported PHP versions and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.
Title PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service
Weaknesses CWE-611
CWE-776
References
Metrics cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:L/SI:N/SA:N'}

Subscriptions

Phpoffice Phpspreadsheet
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-23T21:08:28.517Z

Reserved: 2026-10-09T20:32:44.301Z

Link: CVE-2026-108358

cve-icon Vulnrichment

Updated: 2026-10-23T17:32:56.816Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-22T18:17:26.553

Modified: 2026-10-23T22:16:53.307

Link: CVE-2026-108358

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T19:00:16Z

Weaknesses
  • CWE-611

    Improper Restriction of XML External Entity Reference

  • CWE-776

    Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')