PhpSpreadsheet CVE-2026-108359

The only prerequisite is that the target application loads an attacker-supplied OpenDocument Spreadsheet (.ods) through PhpSpreadsheet's Ods reader; the advisory states no authentication, no special configuration, and only the default read filter are required, so default deployments are affected. The trigger is a single <table:table-row> carrying a large table:number-rows-repeated value whose row contains a cell value (empty rows are not the vector, and column repetition is separately bounded and not exploitable). The practical limiting factor is exposure of the ODS parsing path to untrusted input: applications that only process trusted/internally-generated ODS files, or that do not expose the Ods reader to external files, are not realistically exploitable even on affected versions.

This is a genuine availability-only denial-of-service issue in the PhpSpreadsheet ODS reader (CWE-400 / CWE-789), not a code-execution or data-exposure flaw. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 8.7 and is internally consistent with the advisory: no authentication, no special configuration, and the default read filter are required, and the impact is confined to availability (VC:N/VI:N/VA:H). The reader materializes one Cell object per repeated row from an unbounded table:number-rows-repeated attribute, so a ~1.4 KB file can instruct creation of millions of cells and exhaust PHP memory. The decision signals are moderate rather than critical: vuln.today assigns 'this_week' (not act_now/emergency), the CVE is not listed in CISA KEV, and no EPSS probability was provided in the input - so exploitation-likelihood scoring could not be cross-referenced. The GHSA advisory includes a working reproduction payload and precise source-to-sink analysis, so weaponization is trivial for any attacker who can submit an .ods file, but the ceiling of harm is a crashed/OOM-killed PHP worker, not compromise. Net: a real, prioritizable DoS for any service that parses untrusted ODS uploads, correctly rated below true-critical because confidentiality and integrity are untouched.

An attacker uploads a tiny (~1.4 KB) malicious .ods file to any web application that parses spreadsheets with PhpSpreadsheet's Ods reader. The file contains a single valued row with table:number-rows-repeated set to a huge value (e.g. 5,000,000), causing the reader to allocate millions of Cell objects and hit PHP's memory limit, killing the worker. The GHSA advisory publishes a complete reproduction payload, so no custom tooling is needed.