Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-108359— PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)

Quick assessment

Affected
PHPOffice PhpSpreadsheet
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

PhpSpreadsheet 是一个用于读写电子表格文件的纯 PHP 库。在 1.30.7、2.1.19、2.4.8、3.10.8 和 5.10.0 版本之前，位于 src/PhpSpreadsheet/Reader/Ods.php 中的 Ods::processTableRow 方法会接受 ODS 表格行中无上限的 table:number-rows-repeated 属性。当该行包含该属性值时，读取器会为每次重复实例化一个单元格，且未检查电子表格的行数限制。因此，攻击者控制的小型 ODS 文件即可消耗大量 CP

CVSS 8.7 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 5

VendorProduct Version RangeStatus
PHPOffice PhpSpreadsheet < 1.30.7 affected
>= 2.0.0, < 2.1.19 affected
>= 2.2.0, < 2.4.8 affected
>= 3.3.0, < 3.10.8 affected
>= 4.0.0, < 5.10.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-108359

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)
Source: CVE Program / CVE List V5
Vulnerability Description
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Ods::processTableRow in src/PhpSpreadsheet/Reader/Ods.php accepts an unbounded table:number-rows-repeated attribute from an ODS table row. When the row contains a value, the reader materializes a cell for every repetition without checking the spreadsheet row limit, so a small attacker-controlled ODS file can consume substantial CPU and memory and terminate the PHP worker. Column repetition is separately bounded and is not part of this vulnerability. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
PHPOffice PhpSpreadsheet < 1.30.7 -

II. Public POCs for CVE-2026-108359

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-108359

请登录查看更多情报信息。

Other References for CVE-2026-108359 (11)

Same Patch Batch · PHPOffice · 2026-10-22 · 4 CVEs total

CVE-2026-108357 8.8 HIGH PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Deni
CVE-2026-108358 8.8 HIGH PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of S
CVE-2026-108360 6.4 MEDIUM PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath

IV. Related Vulnerabilities

Same product: PhpSpreadsheet
Same vendor: PHPOffice
Same weakness: CWE-400

V. Comments for CVE-2026-108359

No comments yet

Leave a comment