CVE-2026-108357: 
PHP vulnerability analysis and mitigation

CVE-2026-108357 is a high-severity vulnerability in PHPOffice/PhpSpreadsheet's SpreadsheetML XML reader that allows attackers to bypass the XmlScanner security check via a double-encoded entity technique, enabling XML External Entity (XXE) injection and Denial of Service (DoS). It affects versions >=4.0.0, <=5.9.0 and >=3.3.0, <=3.10.7 of the phpoffice/phpspreadsheet Composer package. The vulnerability was published on October 12, 2026, by maintainer oleibman. It is classified as High severity; a formal CVSS score has not been published in the available sources (GitHub Advisory).

The root cause is a Time-of-Check to Time-of-Use (TOCTOU) flaw in XmlScanner::scan(), classified under CWE-611 (Improper Restriction of XML External Entity Reference) and CWE-776 (Improper Restriction of Recursive Entity References in DTDs). The Xml reader invokes XmlScanner::scan() twice: once during initial load and once before passing content to simplexml_load_string(). Each scan runs an unentity() callback that calls html_entity_decode() after the security pattern check. By double-encoding < as <, the first scan's pattern check sees no literal < and passes, then decodes &# to & (yielding <); the second scan's pattern check again sees no literal < and passes, then decodes < to < — so the XML parser ultimately receives a fully-formed <!DOCTYPE> with entity declarations that were never caught by either check. A proof-of-concept PHP script crafting a poc.xml file with double-encoded <!DOCTYPE> and <!ENTITY> declarations has been demonstrated, confirming entity expansion consuming ~45 MB of memory and filling cell A1 with 32,767 bytes (GitHub Advisory).

Successful exploitation can result in Denial of Service via quadratic entity blowup (exploitable on all PHP/libxml2 versions), local file read via SYSTEM entity references (exploitable on PHP <8.0 / libxml2 <2.9; blocked by default on newer versions), and Server-Side Request Forgery (SSRF) via SYSTEM entity (similarly blocked by default on PHP 8.x / libxml2 2.9+, but exploitable on older stacks). When LIBXML_NOENT is used, file read is exploitable regardless of PHP or libxml2 version. Any application that accepts user-uploaded SpreadsheetML XML files and processes them with PhpSpreadsheet's Xml reader is affected (GitHub Advisory).

A public proof-of-concept script is included in the GitHub Security Advisory, demonstrating entity expansion, memory exhaustion, and cell value confirmation. The vulnerability requires only the ability to upload or supply a malicious SpreadsheetML XML file to an application using the affected reader — no authentication to PhpSpreadsheet itself is required. No evidence of in-the-wild exploitation, threat actor attribution, EPSS score, or CISA KEV catalog listing is available at this time (GitHub Advisory).

1. Craft malicious XML: Create a SpreadsheetML XML file where < characters in <!DOCTYPE> and <!ENTITY> declarations are double-encoded as < (or hex variant <). For example:

<!DOCTYPE Workbook [
  <!ENTITY big "AAAA..." (large value)>
]>

2. Upload or supply the file: Deliver the crafted poc.xml to any application endpoint that accepts SpreadsheetML XML uploads and processes them with PhpOffice\PhpSpreadsheet\Reader\Xml.
3. Trigger first scan bypass: PhpSpreadsheet's first call to XmlScanner::scan() checks for < in the raw content — finds none (only <), passes the check, then html_entity_decode() converts &# → &, storing < in $this->fileContents.
4. Trigger second scan bypass: The second call to XmlScanner::scan() on the stored content checks for < — finds none (only <), passes the check, then html_entity_decode() converts < → <, yielding fully-formed DOCTYPE/ENTITY declarations.
5. Achieve XXE or DoS: simplexml_load_string() receives the fully decoded XML with active entity declarations. On PHP <8.0/libxml2 <2.9, this enables local file read or SSRF; on all versions, recursive/quadratic entity expansion causes memory exhaustion (DoS) (GitHub Advisory).

• File System: Uploaded XML files containing double-encoded entity sequences such as <!DOCTYPE, <!ENTITY, <!DOCTYPE, or <!ENTITY in SpreadsheetML content.
• Logs: PHP error logs or application logs showing excessive memory usage or memory_get_peak_usage spikes when processing uploaded XML files; PHP fatal errors related to memory limit exhaustion during spreadsheet parsing.
• Process: PHP worker processes consuming abnormally high memory (e.g., >100 MB) when handling file uploads; processes hanging or timing out during XML parsing.
• Network: Unexpected outbound HTTP/FTP requests from the web server process to internal or external hosts (indicative of SSRF via SYSTEM entity on vulnerable libxml2 versions) (GitHub Advisory).

Upgrade to patched versions 5.10.0 (for the 4.x–5.x branch) or 3.10.8 (for the 3.x branch) of phpoffice/phpspreadsheet via Composer (composer update phpoffice/phpspreadsheet). No official configuration-based workaround is described; as an interim measure, applications should avoid accepting SpreadsheetML XML uploads from untrusted sources, or validate and sanitize uploaded files before passing them to the Xml reader. Running PHP 8.x with libxml2 2.9+ reduces (but does not eliminate) the attack surface by blocking external entity resolution by default (GitHub Advisory).