Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-108357— PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service

Quick assessment

Affected
PHPOffice PhpSpreadsheet
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

PhpSpreadsheet 是一个用于读写电子表格文件的纯 PHP 库。在 3.3.0 至 3.10.8 以及 5.10.0 版本中，Reader\Xml 组件会在 Xml::canRead 和 Xml::trySimpleXMLLoadStringPrivate 方法中，将存储的 SpreadsheetML XML 传递给 XmlScanner::scan 进行处理；而 Xml::unentity 方法仅在每次 DOCTYPE 模式检查之后才对数字实体进行解码。当遇到双重编码的小于号（<）时，第一个回调会将其转

CVSS 8.8 · High

Affected Version Matrix 2

VendorProduct Version RangeStatus
PHPOffice PhpSpreadsheet >= 3.3.0, < 3.10.8 affected
>= 4.0.0, < 5.10.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-108357

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service
Source: CVE Program / CVE List V5
Vulnerability Description
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored SpreadsheetML XML through XmlScanner::scan in Xml::canRead and Xml::trySimpleXMLLoadStringPrivate, while Xml::unentity decodes numeric entities only after each DOCTYPE pattern check. A double-encoded less-than character is reduced by the first callback to another encoded character and by the second callback to a literal less-than sign, so SimpleXML receives an unchecked DOCTYPE and entity declaration. Processing attacker-controlled SpreadsheetML XML can cause entity-expansion denial of service and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 3.10.8 and 5.10.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:L/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
XML外部实体引用的不恰当限制(XXE)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
PHPOffice PhpSpreadsheet >= 3.3.0, < 3.10.8 -

II. Public POCs for CVE-2026-108357

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-108357

请登录查看更多情报信息。

Other References for CVE-2026-108357 (5)

Same Patch Batch · PHPOffice · 2026-10-22 · 4 CVEs total

CVE-2026-108358 8.8 HIGH PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of S
CVE-2026-108359 8.7 HIGH PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)
CVE-2026-108360 6.4 MEDIUM PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath

IV. Related Vulnerabilities

Same product: PhpSpreadsheet
Same vendor: PHPOffice
Same weakness: CWE-611

V. Comments for CVE-2026-108357

No comments yet

Leave a comment