EUVD-2026-108242Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUpload crafted SpreadsheetML XML file
-
DeliveryDouble-encoded '<' bypasses both XmlScanner checks
-
ExploitSecond unentity pass forms live DOCTYPE/ENTITY
-
ExecutionSimpleXML expands entities or resolves SYSTEM
-
ImpactMemory-exhaustion DoS or file read/SSRF
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A02:2025 - Security Misconfiguration
ASVS 5.0
V13 - Configuration XML external entity prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an application to accept attacker-controlled SpreadsheetML (Excel 2003 XML) input - recognized by the <?mso-application progid="Excel.Sheet"?> processing instruction - and pass it through PhpSpreadsheet's Reader\Xml (canRead/load) on an affected version (3.3.0 through 3.10.7, or 4.0.0 through 5.9.0). The trigger is a double-encoded less-than character (&#60; or hex &#x3C;) that unentity() decodes across the two scan() passes, smuggling a DOCTYPE/ENTITY block past the scanner. Denial of service via entity expansion applies on all PHP versions. The confidentiality/SSRF outcomes are LIMITED to PHP < 8.0 or libxml2 < 2.9, or any PHP version where the application explicitly enables LIBXML_NOENT; default PHP 8.x / libxml2 2.9+ blocks external-entity file read and SSRF. No authentication to PhpSpreadsheet is required and no user interaction beyond the application ingesting the file. |
| Impact | Signals are mostly consistent but point to high-priority-not-emergency. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes easy remote, unauthenticated, low-complexity triggering by an attacker who fully controls the malicious file, and the vuln.today Decision label is 'this_week'. A full, author-tested proof-of-concept is published in the vendor's own GHSA advisory (tested on PhpSpreadsheet 5.9.0 / PHP 8.5.3), raising practical exploitability. However, impact is split and partly conditional, which the VC:L/VA:H scoring reflects: entity-expansion denial of service is exploitable on ALL PHP versions, but local file read and SSRF via SYSTEM entities only occur on PHP < 8.0 / libxml2 < 2.9 or when LIBXML_NOENT is explicitly enabled - on default PHP 8.x these are blocked, leaving DoS as the guaranteed outcome. No EPSS score and no CISA KEV status were supplied in the input, so widespread or in-the-wild exploitation is NOT confirmed; treat the 8.8 as a credible high-severity issue whose confidentiality component depends heavily on the target's PHP/libxml2 version and configuration. |
| Exploit ScenarioDerived | An application that accepts user-uploaded spreadsheets and parses them with PhpSpreadsheet's Reader\Xml receives a crafted SpreadsheetML file (identified by the <?mso-application progid="Excel.Sheet"?> processing instruction) containing a double-encoded '<' (&#60;). The two XmlScanner::scan() passes each decode one layer after their DOCTYPE pattern check, so a live <!DOCTYPE/<!ENTITY reaches SimpleXML unchecked, causing memory-exhaustion denial of service on any PHP version, and local file read or SSRF on PHP < 8.0 or when LIBXML_NOENT is set. A working, reporter-tested PoC is included in the vendor security advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
PhpSpreadsheet's SpreadsheetML reader (Reader\Xml) can be induced to pass a DOCTYPE/ENTITY block into SimpleXML despite its entity-blocking scanner, because the scanner's html_entity_decode callback runs after the pattern check and the content is scanned twice. Files containing a double-encoded less-than character (&#60; or &#x3C;) smuggle a literal '<!DOCTYPE' past both passes, so processing attacker-controlled XML with the Xml reader yields entity-expansion denial of service on all PHP versions, plus local file read or SSRF where external entities are still resolved (PHP before 8.0, libxml2 before 2.9, or any PHP build with LIBXML_NOENT enabled). Affected releases are 3.3.0 through 3.10.7 and 4.0.0 through 5.9.0; vendor fixes are released as 3.10.8 and 5.10.0. No CISA KEV listing or confirmed active exploitation is reported, but the vendor advisory itself publishes a proof-of-concept that was reportedly exercised against PhpSpreadsheet 5.9.0, and the priority signal places remediation in the this-week band rather than emergency.
RemediationAI
Upgrade to PhpSpreadsheet 3.10.8 (for the 3.x line) or 5.10.0 (for the 4.x/5.x line); both are vendor-released patch versions and the only complete fix, since the change is inside the library's own unentity()/XmlScanner code rather than in libxml. Release notes are at https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.8 and https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.10.0, and the underlying changes are visible in commits 89f455c133e1a7e2d4abfadc43ce29eb7450d781 and 980b5c294493856f1a25754f1e8a1d2185b93738. If an immediate upgrade is not possible, stop routing untrusted uploads through Reader\Xml - either reject files containing the <?mso-application progid="Excel.Sheet"?> processing instruction or force use of the Xlsx/Xls readers for known-good formats, accepting the loss of legacy SpreadsheetML support; audit that the application never sets LIBXML_NOENT, since enabling it restores the file-read and SSRF paths on modern PHP; and note that running on PHP 8.x with libxml2 2.9+ limits the residual risk to entity-expansion denial of service only, which can be blunted by capping upload size, memory_limit and request timeouts for spreadsheet parsing, at the cost of rejecting very large legitimate workbooks. Any compensating control should be treated as temporary, since the parsing path remains bypassable until the patched library version is deployed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic XML External Entity weakness (CWE-611, with the related expansion-amplification class CWE-776) that arises not in libxml but in PhpSpreadsheet's own pre-parse sanitizer stack. Reader\Security\XmlScanner::scan() applies a regex looking for obfuscated '<!DOCTYPE' sequences to the raw string and again after toUtf8(), and only afterwards invokes its callback, Xml::unentity(), which calls html_entity_decode(). Xml::canRead() runs scan() once and stores the partially decoded content in fileContents; Xml::trySimpleXMLLoadStringPrivate() then runs scan() a second time on that stored string before handing it to simplexml_load_string(). Because each decode happens after each check, a payload written as &#60;!DOCTYPE survives the first check, is reduced to <!DOCTYPE by the first callback, survives the second check, and is reduced to a literal <!DOCTYPE by the second callback - so SimpleXML parses an entity declaration the scanner never saw. unentity() shields only the five named XML entities (& < > " ') via Unicode placeholders; numeric entities (&, <, &, <) are not shielded and are decoded. The consequences split by platform: internal entity expansion (quadratic blowup) works everywhere, while external SYSTEM entities - the file-read and SSRF paths - are resolved only on PHP before 8.0 / libxml2 before 2.9 or wherever the consuming application explicitly sets LIBXML_NOENT. The upstream fix reworks unentity() to protect numeric entities with a positive lookahead and to escape remaining ampersands, and adds a BOM-versus-declared-encoding consistency check in XmlScanner::toUtf8() that throws when a UTF-8 BOM contradicts the declared encoding.
Know when Phpspreadsheet gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:L/SI:N/SA:N
Attacker fully controls the uploaded file (AC:L) processed without auth over the network (AV:N, PR:N, UI:N); guaranteed DoS gives A:H, while version/config-gated file read/SSRF yields only C:L.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored SpreadsheetML XML through XmlScanner::scan in Xml::canRead and Xml::trySimpleXMLLoadStringPrivate, while Xml::unentity decodes numeric entities only after each DOCTYPE pattern check. A double-encoded less-than character is reduced by the first callback to another encoded character and by the second callback to a literal less-than sign, so SimpleXML receives an unchecked DOCTYPE and entity declaration. Processing attacker-controlled SpreadsheetML XML can cause entity-expansion denial of service and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 3.10.8 and 5.10.0.
Technical POC Analysis
CWE-611 (with CWE-776 as the DoS consequence): the entity guard in PhpSpreadsheet's SpreadsheetML reader is a decode-after-check TOCTOU across two scan passes.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
PhpSpreadsheet, a widely used PHP library for reading spreadsheet files, is affected by a high-severity flaw (CVE-2026-108357) in versions 3.3.0-3.10.7 and 4.0.0-5.9.0 that lets attacker-supplied files trigger denial-of-service and, on older PHP/libxml2 configurations, potential local file disclosure or SSRF. Any application or service that processes untrusted spreadsheet/XML uploads is exposed, so leadership should treat this as an availability and data-exposure risk wherever user-controlled files are parsed. Vendor fixes exist, making remediation straightforward and time-sensitive.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
XML External Entity (XXE) attacks exploit XML parsers that process Document Type Definitions (DTDs) without proper restrictions.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Phpspreadsheet
View allPHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Rated high severity (CVSS 8.8), this vul
PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. Rated high severity (CVSS 8.8), this vulnerability is remotely e
securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 enco
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Rated high severity (CVSS 7.5), this vulnerab
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Rated high severity (CVSS 7.5), this vulnerab
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Rated high severity (CVSS 7.5), this vul
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Rated high severity (CVSS 7.5), this vul
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Rated medium severity (CVSS 6.5), this v
This affects the package phpoffice/phpspreadsheet from 0.0.0. Rated medium severity (CVSS 6.4), this vulnerability is re
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Rated medium severity (CVSS 6.1), this v
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Rated medium severity (CVSS 5.4), this v
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Rated medium severity (CVSS 5.4), this v
Exploit-DB