CVE-2026-108359 in PhpSpreadsheet
Summary
by MITRE • 10/22/2026
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Ods::processTableRow in src/PhpSpreadsheet/Reader/Ods.php accepts an unbounded table:number-rows-repeated attribute from an ODS table row. When the row contains a value, the reader materializes a cell for every repetition without checking the spreadsheet row limit, so a small attacker-controlled ODS file can consume substantial CPU and memory and terminate the PHP worker. Column repetition is separately bounded and is not part of this vulnerability. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The PhpSpreadsheet library serves as a widely adopted pure PHP solution for reading and writing spreadsheet files in various formats including ODS, XLSX, and CSV. Within the context of application security, libraries that process untrusted file inputs are critical attack surfaces because they often handle complex parsing logic that can be exploited through malformed or maliciously crafted documents. The vulnerability identified here resides specifically within the OpenDocument Spreadsheet reader component, which is responsible for interpreting ODS files. This component contains a function named processTableRow located in the src/PhpSpreadsheet/Reader/Ods.php file. While column repetitions are properly bounded to prevent excessive resource consumption along that axis, row repetitions were not subjected to similar constraints prior to specific version updates.
The core technical flaw involves an unbounded loop triggered by the table:number-rows-repeated attribute within an ODS XML structure. When the reader processes a table row that contains actual data values, it iterates through the number specified in this attribute to materialize individual cell objects for each repetition. Crucially, the implementation fails to validate whether the cumulative count of these generated rows exceeds the maximum allowable spreadsheet dimensions defined by the application or standard limits. An attacker can craft a small ODS file where this attribute is set to an extremely large integer value while keeping the actual XML payload minimal in size. Upon processing such a document, the PHP worker attempts to instantiate millions of cell objects simultaneously.
This lack of input validation leads directly to severe operational impacts characterized by resource exhaustion. The immediate consequence is a significant spike in CPU usage as the parser processes the repetitive instructions, coupled with substantial memory allocation failures or excessive consumption due to the creation of numerous object instances. In many hosting environments and web server configurations, this behavior results in the termination of the PHP worker process. For applications relying on PhpSpreadsheet to handle user-uploaded files, such as document management systems or data import tools, this vulnerability effectively enables a Denial of Service attack. An attacker does not need code execution privileges; simply uploading a maliciously crafted ODS file is sufficient to disrupt service availability and potentially cause instability in the underlying server infrastructure.
From a classification perspective, this issue aligns with CWE-400 which describes uncontrolled resource consumption. The exploitation technique involves crafting specific input data that triggers excessive processing or allocation, fitting the profile of an inefficient regular expression complexity attack if viewed broadly as algorithmic complexity abuse, though it is more accurately categorized under improper validation of array bounds or limits. In terms of MITRE ATT&CK mapping, this vulnerability supports techniques related to Resource Hijacking and Denial of Service via application layer attacks where availability is compromised through resource exhaustion rather than service crash from memory corruption.
Mitigation strategies primarily involve upgrading the PhpSpreadsheet library to patched versions that include fixes for this specific logic error. The affected versions 1.30.6 and earlier, 2.1.18 and earlier, 2.4.7 and earlier, 3.10.7 and earlier, and 5.9.0 and earlier are vulnerable. Administrators must upgrade to version 1.30.7, 2.1.19, 2.4.8, 3.10.8, or 5.10.0 respectively where the row repetition limit is properly enforced. In addition to upgrading dependencies, organizations should implement defense-in-depth measures such as validating file types strictly before processing and imposing limits on memory usage within PHP configurations using directives like memory_limit. Furthermore, integrating web application firewalls that can detect anomalous spikes in resource consumption during file parsing may provide an additional layer of protection against exploitation attempts while patching is being implemented.