PHPOffice PhpSpreadsheet up to 3.10.7/5.9.x Xml Scanner XmlScanner::scan server-side request forgery

Summaryinfo

A vulnerability classified as critical was found in PHPOffice PhpSpreadsheet up to 3.10.7/5.9.x. Affected by this vulnerability is the function XmlScanner::scan of the component Xml Scanner. Such manipulation leads to server-side request forgery. This vulnerability is listed as CVE-2026-108357. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in PHPOffice PhpSpreadsheet up to 3.10.7/5.9.x. It has been rated as critical. Affected by this issue is the function XmlScanner::scan of the component Xml Scanner. The manipulation with an unknown input leads to a server-side request forgery vulnerability. Using CWE to declare the problem leads to CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Impacted is confidentiality, integrity, and availability. CVE summarizes:

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored SpreadsheetML XML through XmlScanner::scan in Xml::canRead and Xml::trySimpleXMLLoadStringPrivate, while Xml::unentity decodes numeric entities only after each DOCTYPE pattern check. A double-encoded less-than character is reduced by the first callback to another encoded character and by the second callback to a literal less-than sign, so SimpleXML receives an unchecked DOCTYPE and entity declaration. Processing attacker-controlled SpreadsheetML XML can cause entity-expansion denial of service and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 3.10.8 and 5.10.0.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-108357 since 10/09/2026. The exploitation is known to be easy. The attack may be launched remotely. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

Upgrading to version 3.10.8 or 5.10.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-108242). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• PHPOffice

Name

• PhpSpreadsheet

Version

• 3.10.0
• 3.10.1
• 3.10.2
• 3.10.3
• 3.10.4
• 3.10.5
• 3.10.6
• 3.10.7
• 5.0
• 5.1
• 5.2
• 5.3
• 5.4
• 5.5
• 5.6
• 5.7
• 5.8
• 5.9

Website

• Product: https://github.com/PHPOffice/PhpSpreadsheet/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion