CVE-2026-108358: PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service
PhpSpreadsheet’s XmlScanner::scan() uses a regex pattern that only accounts for NULL byte (0x00) interleaving when detecting <!DOCTYPE. ISO-2022 escape sequences (0x1B bytes) inserted between the characters of the pattern break the regex match entirely, allowing DOCTYPE declarations with entity definitions to pass through undetected. This enables Denial of Service via quadratic entity expansion on all PHP versions, and XXE/SSRF on PHP < 8.0 or when LIBXML_NOENT is used. Any application using PhpSpreadsheet to process user-uploaded XLSX files is affected.
References
- github.com/PHPOffice/PhpSpreadsheet/commit/299993894dce37aa3b64aa23e9a3f4bb77ab0e66
- github.com/PHPOffice/PhpSpreadsheet/commit/89f455c133e1a7e2d4abfadc43ce29eb7450d781
- github.com/PHPOffice/PhpSpreadsheet/commit/980b5c294493856f1a25754f1e8a1d2185b93738
- github.com/PHPOffice/PhpSpreadsheet/commit/9a0b48622ebfe93fa48cb9bc09ce57303bb07af9
- github.com/PHPOffice/PhpSpreadsheet/commit/da13f40e8760d599b0e8a296017d4b028b20e86c
- github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.7
- github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.19
- github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.8
- github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.8
- github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.10.0
- github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-3x94-m842-937c
- github.com/advisories/GHSA-3x94-m842-937c
- nvd.nist.gov/vuln/detail/CVE-2026-108358
Code Behaviors & Features
Detect and mitigate CVE-2026-108358 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →