Skip to content
Fencer Vulns
high 8.8

CVE-2026-108357 json

PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service

published 2026-10-22 18 d ago modified 2026-10-27 13 d ago also EUVD-2026-108242 , GHSA-rxj4-h86g-25gc

cvss
8.8
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 40%
public exploits
0
none known

Summary

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored SpreadsheetML XML through XmlScanner::scan in Xml::canRead and Xml::trySimpleXMLLoadStringPrivate, while Xml::unentity decodes numeric entities only after each DOCTYPE pattern check. A double-encoded less-than character is reduced by the first callback to another encoded character and by the second callback to a literal less-than sign, so SimpleXML receives an unchecked DOCTYPE and entity declaration. Processing attacker-controlled SpreadsheetML XML can cause entity-expansion denial of service and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 3.10.8 and 5.10.0.

Patch / fix

  • packagist phpoffice/phpspreadsheet 3.10.8, 5.10.0
  • phpoffice phpspreadsheet 3.10.8, 5.10.0
  • phpspreadsheet_project phpspreadsheet 3.10.8, 5.10.0

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
17 d ago

Exploit prediction

0.46% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:L/SI:N/SA:N
CNA 4.0 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
packagist phpoffice/phpspreadsheet
>=4.0.0, <5.10.0
>=3.3.0, <3.10.8
5.10.0
3.10.8

Affected products

  • PHPOffice PhpSpreadsheet

Classification

Weakness
  • CWE-611 Improper Restriction of XML External Entity Reference
  • CWE-776 Improper Restriction of Recursive Entity References in DTDs

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.