CVE-2026-108358 in PhpSpreadsheet
Summary
by MITRE • 10/23/2026
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that accounts for NUL-byte interleaving but not ISO-2022 escape sequences in XLSX XML parts. The escape sequences prevent the scanner from matching the declaration, and XML charset normalization then removes the escape bytes before parsing, exposing a valid DOCTYPE and entity definitions. Processing an attacker-controlled XLSX can therefore cause entity-expansion denial of service on supported PHP versions and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
PhpSpreadsheet serves as a widely adopted pure PHP library designed for the creation and manipulation of spreadsheet files in various formats including XLSX. The vulnerability identified within this library stems from an insufficient input validation mechanism located in the XmlScanner class, specifically within its scan method found at src/PhpSpreadsheet/Reader/Security/XmlScanner.php. This component is responsible for sanitizing XML content to prevent malicious payloads such as external entity injections or document type definition attacks. The core technical flaw lies in the regular expression pattern used to detect DOCTYPE declarations. While the implementation correctly accounts for NUL-byte interleaving, a common obfuscation technique where null characters are inserted between bytes of a string to bypass naive filters, it fails to account for ISO-2022 escape sequences. These sequences allow for character set switching within ASCII streams and can be used to hide or alter the representation of critical XML keywords like DOCTYPE in a way that evades detection by the scanner's pattern matching logic.
The operational impact of this flaw is significant because it allows an attacker-controlled XLSX file, which contains specially crafted XML parts with ISO-2022 escape sequences, to bypass security checks during parsing. When the library processes such a file, the XmlScanner fails to identify and block the malicious DOCTYPE declaration due to the encoding anomaly. Subsequently, when LIBXML performs charset normalization on the document prior to full parsing, it strips out these specific escape bytes. This process effectively reveals a valid and unblocked DOCTYPE definition along with associated entity definitions that were previously obscured from the security scanner. Consequently, the XML parser proceeds to process these entities as if they were legitimate content, leading to severe security consequences depending on the server configuration and PHP version in use.
For systems running PHP versions prior to 8.0 or those where the LIBXML_NOENT flag is explicitly enabled during parsing, this vulnerability permits local file access and Server-Side Request Forgery attacks. Local file access allows an attacker to read sensitive files from the underlying operating system by defining entities that reference local paths using protocols such as file://. Similarly, SSRF enables the server to make requests to internal or external network resources on behalf of the application, potentially leading to further compromise of internal infrastructure or data exfiltration. Even in environments where direct exploitation for remote code execution is not possible, the vulnerability can be leveraged to cause a denial of service through entity expansion attacks. By defining entities that recursively reference each other or expand into massive amounts of text, an attacker can exhaust server memory and CPU resources, rendering the application unavailable to legitimate users.
This issue aligns with CWE-20 Improper Input Validation as the root cause is the failure to properly validate XML input against a comprehensive set of obfuscation techniques. It also maps to ATT&CK technique T1568.002 Dynamic Resolution which involves using domain generation algorithms or similar mechanisms to evade detection, although in this context it refers more broadly to dynamic encoding evasion within the XML structure itself. The vulnerability highlights the critical importance of handling character set transformations and escape sequences when implementing security filters for markup languages like XML. Developers must ensure that sanitization logic is robust against all standard encoding manipulations defined by relevant standards such as ISO-2022-JP or similar variants used in spreadsheet formats to prevent bypasses through non-standard byte representations.
Mitigation requires immediate upgrading of the PhpSpreadsheet library to patched versions including 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0 where this logic has been corrected to properly detect DOCTYPE declarations even when obscured by ISO-2022 escape sequences. In addition to upgrading, organizations should review their configuration of the LIBXML_NOENT flag in PHP applications that process user-supplied XML data. Disabling this flag unless absolutely necessary reduces the risk of external entity expansion attacks. Implementing strict allowlists for permitted protocols and entities within any custom XML parsing logic further hardens the application against such exploits. Regular security audits focusing on input validation patterns, particularly those involving character encoding and escape sequence handling, are essential to maintain resilience against evolving obfuscation techniques used in XML-based attacks.