Read the docs
TI-2026-79332 Aliases CVE-2026-108358GHSA-3x94-m842-937c

PhpSpreadsheet XML scanner bypass allows XXE and denial of service

Priority MEDIUM 45CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

PhpSpreadsheet before 1.30.7, from 2.0.0 before 2.1.19, from 2.2.0 before 2.4.8, from 3.3.0 before 3.10.8 and from 4.0.0 before 5.10.0 is affected. Its XML scanner detects DOCTYPE declarations in XLSX XML parts but misses ISO-2022 escape sequences, so charset normalization later removes the escape bytes and exposes an entity definition before parsing (CWE-611). An attacker who controls an XLSX file processed by the application can cause entity-expansion denial of service. On PHP before 8.0 or when LIBXML_NOENT is enabled, the attacker can also read local files or perform SSRF.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that accounts for NUL-byte interleaving but not ISO-2022 escape sequences in XLSX XML parts. The escape sequences prevent the scanner from matching the declaration, and XML charset normalization then removes the escape bytes before parsing, exposing a valid DOCTYPE and entity definitions. Processing an attacker-controlled XLSX can therefore cause entity-expansion denial of service on supported PHP versions and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00625 50th percentileScored 2026-11-07
Fix Fixed PhpSpreadsheet (PHPOffice): 1.30.7, 2.1.19, 2.4.8 +2phpoffice/phpspreadsheet (Packagist): 5.10.0, 3.10.8, 2.4.8 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PHPOfficePhpSpreadsheetbefore 1.30.7; 2.0.0 to before 2.1.19; 2.2.0 to before 2.4.8; 3.3.0 to before 3.10.8; 4.0.0 to before 5.10.01.30.7, 2.1.19, 2.4.8, 3.10.8, 5.10.0Patch availableCNA
—phpoffice/phpspreadsheet (Packagist)4.0.0 to before 5.10.05.10.0Patch availableGHSA-3x94-m842-937c
—phpoffice/phpspreadsheet (Packagist)3.3.0 to before 3.10.83.10.8Patch availableGHSA-3x94-m842-937c
—phpoffice/phpspreadsheet (Packagist)2.2.0 to before 2.4.82.4.8Patch availableGHSA-3x94-m842-937c
—phpoffice/phpspreadsheet (Packagist)2.0.0 to before 2.1.192.1.19Patch availableGHSA-3x94-m842-937c
—phpoffice/phpspreadsheet (Packagist)before 1.30.71.30.7Patch availableGHSA-3x94-m842-937c
  • PhpSpreadsheet VendorPHPOffice Affected before 1.30.7; 2.0.0 to before 2.1.19; 2.2.0 to before 2.4.8; 3.3.0 to before 3.10.8; 4.0.0 to before 5.10.0 Fixed in 1.30.7, 2.1.19, 2.4.8, 3.10.8, 5.10.0 Patch available CNA
  • phpoffice/phpspreadsheet (Packagist) Vendor— Affected 4.0.0 to before 5.10.0 Fixed in 5.10.0 Patch available GHSA-3x94-m842-937c
  • phpoffice/phpspreadsheet (Packagist) Vendor— Affected 3.3.0 to before 3.10.8 Fixed in 3.10.8 Patch available GHSA-3x94-m842-937c
  • phpoffice/phpspreadsheet (Packagist) Vendor— Affected 2.2.0 to before 2.4.8 Fixed in 2.4.8 Patch available GHSA-3x94-m842-937c
  • phpoffice/phpspreadsheet (Packagist) Vendor— Affected 2.0.0 to before 2.1.19 Fixed in 2.1.19 Patch available GHSA-3x94-m842-937c
  • phpoffice/phpspreadsheet (Packagist) Vendor— Affected before 1.30.7 Fixed in 1.30.7 Patch available GHSA-3x94-m842-937c

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*——PHPOffice
  • cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:* Versions — — ·PHPOffice

Remediation

Upgrade to PhpSpreadsheet 1.30.7, 2.1.19, 2.4.8, 3.10.8 or 5.10.0, using the fixed version on the release line in use. The Packagist package phpoffice/phpspreadsheet has the same fixed versions.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA PhpSpreadsheet (PHPOffice) Fixed in 1.30.7, 2.1.19, 2.4.8, 3.10.8, 5.10.0
  • Fix · GHSA-3x94-m842-937c phpoffice/phpspreadsheet (Packagist) Fixed in 5.10.0 Advisory →
  • Fix · GHSA-3x94-m842-937c phpoffice/phpspreadsheet (Packagist) Fixed in 3.10.8 Advisory →
  • Fix · GHSA-3x94-m842-937c phpoffice/phpspreadsheet (Packagist) Fixed in 2.4.8 Advisory →
  • Fix · GHSA-3x94-m842-937c phpoffice/phpspreadsheet (Packagist) Fixed in 2.1.19 Advisory →
  • Fix · GHSA-3x94-m842-937c phpoffice/phpspreadsheet (Packagist) Fixed in 1.30.7 Advisory →

Timeline

  1. 2026-10-22 Threatist record created from CVE-2026-108358
  2. 2026-10-23 Priority changed: MEDIUM → LOW
  3. 2026-10-24 CISA SSVC decision points changed
  4. 2026-10-24 Priority changed: LOW → MEDIUM
  5. 2026-10-27 Alias added: GHSA-3x94-m842-937c
  6. 2026-11-03 EPSS moved to the 50th–90th percentile

References

Advisory 1

Other 12

  • TI-2026-32885 PhpSpreadsheet: File::prohibitWrappers bypass CVSS 4.0CRITICAL 9.2
  • TI-2026-26406 PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load CVSS 4.0CRITICAL 9.2
  • TI-2026-79412 PhpSpreadsheet ODS reader exhausts CPU and memory via repeated rows CVSS 4.0HIGH 8.7
  • TI-2025-34182 PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser CVSS 4.0HIGH 8.7
  • TI-2026-78784 Insecure deserialization in PHPOffice PHPPresentation allows code execution CVSS 4.0CRITICAL 9.2
  • TI-2024-37339 PhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php file CVSS 4.0HIGH 8.3
See all 37 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences