PhpSpreadsheet CVE-2026-108358

The only prerequisite is that the target application accepts and processes an attacker-controlled XLSX file with PhpSpreadsheet's Xlsx reader; the DOCTYPE-scanner bypass works against default configurations with no authentication or user interaction. The denial-of-service via internal (quadratic) entity expansion has NO special conditions and is exploitable on all supported PHP versions because libxml2 2.9+ defaults do not block internal entity expansion. The confidentiality impacts are strictly conditional: local file read and SSRF via external SYSTEM entities are exploitable only on PHP < 8.0 / libxml2 < 2.9, or on any PHP version when the application explicitly parses with the LIBXML_NOENT flag; on modern PHP 8.x without LIBXML_NOENT these are blocked by default. The practical limiting factor is therefore the deployment's PHP/libxml2 version and LIBXML_NOENT usage, not attacker capability.

This is a credible, prioritize-this-week issue rather than a paper-high-CVSS case. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, score 8.8) indicates remote, low-complexity, unauthenticated exploitation with no user interaction, and the vuln.today decision label is 'this_week' - consistent with a real but not emergency priority. The strongest signal is the detailed, author-tested PoC in the GHSA advisory (tested on PhpSpreadsheet 5.9.0 / PHP 8.5.3 / libxml2 2.9.13), demonstrating a working XmlScanner bypass and ~22,000:1 memory amplification; this constitutes publicly available exploit code. Crucially, the signals are split by impact class: the denial-of-service via quadratic entity expansion is exploitable on ALL supported PHP versions and default configurations, while the confidentiality impacts (local file read, SSRF via SYSTEM entities) are limited to PHP < 8.0 / libxml2 < 2.9 or deployments that explicitly pass LIBXML_NOENT - on modern PHP 8.x these are blocked by libxml2 defaults. No CISA KEV listing and no EPSS score were provided, so there is no evidence of active in-the-wild exploitation; absence of these is not itself a contradiction. The main caveat to flag: the headline 8.8/VA:H rating is driven by the universally-exploitable DoS plus the conditional confidentiality (VC:L/SC:L), so operators on modern PHP without LIBXML_NOENT should read the realistic impact as DoS-primarily, with file-read/SSRF applying only to the narrower conditions above - verify your PHP/libxml2 version and LIBXML_NOENT usage.

An attacker uploads a crafted XLSX to any web application that processes user-supplied spreadsheets with PhpSpreadsheet. ISO-2022 escape bytes interleaved inside '<!DOCTYPE' evade XmlScanner::scan(), then XML charset normalization strips those bytes and exposes a valid DOCTYPE with internal entity definitions, so a ~2 KB file expands to ~45 MB of memory; repeated concurrent uploads exhaust server memory. A full, author-tested proof-of-concept is published in the GHSA advisory, and on PHP < 8.0 or when LIBXML_NOENT is set the same bypass additionally enables local file read and SSRF via SYSTEM entities.