CVE-2026-108358: 
PHP vulnerability analysis and mitigation

CVE-2026-108358 is a vulnerability in PhpSpreadsheet's XmlScanner::scan() function that allows attackers to bypass XML security checks via ISO-2022 escape sequences, enabling XML External Entity (XXE) injection and Denial of Service (DoS). Disclosed on October 12, 2026, it affects PhpSpreadsheet versions ≤ 1.30.6, 2.0.0–2.1.18, 2.2.0–2.4.7, 3.3.0–3.10.7, and 4.0.0–5.9.0. It is rated High severity and is classified under CWE-611 and CWE-776 (GitHub Advisory).

The root cause is that XmlScanner::scan() uses a regex pattern that only accounts for NULL byte (0x00) interleaving when detecting dangerous XML constructs such as DOCTYPE declarations. Attackers can bypass this detection by encoding malicious payloads using ISO-2022 escape sequences, which the scanner does not recognize. This allows crafted XLSX files to smuggle DOCTYPE declarations containing internal entity definitions (CWE-776) or SYSTEM entity references pointing to external resources (CWE-611). The bypass works because the ISO-2022 encoded content is decoded by the underlying XML parser (libxml2) after the scanner's regex check has already passed. A proof-of-concept was included in the advisory demonstrating entity expansion from a ~2 KB XLSX file (GitHub Advisory).

The most severe impact is a Denial of Service via quadratic entity blowup: a ~2 KB malicious XLSX file can cause ~45 MB peak memory usage (a 22,000:1 amplification ratio), and multiple concurrent uploads can exhaust server memory. On PHP versions below 8.0 or libxml2 versions below 2.9, attackers can additionally achieve local file read and Server-Side Request Forgery (SSRF) via SYSTEM entity references. Even on modern PHP 8.x / libxml2 2.9+ stacks, the DoS vector remains fully exploitable without any special configuration. Any application that accepts user-uploaded XLSX files and processes them with PhpSpreadsheet is affected (GitHub Advisory).

A proof-of-concept exploit was published as part of the security advisory by reporter e1abrador, demonstrating successful entity expansion on PhpSpreadsheet 5.9.0, PHP 8.5.3, and libxml2 2.9.13. The DoS vector requires no special PHP configuration and is exploitable by any user who can upload an XLSX file to a vulnerable application. No evidence of in-the-wild exploitation, threat actor attribution, EPSS score, or CISA KEV listing is currently available for this CVE (GitHub Advisory).

1. Craft malicious XLSX: Create a minimal XLSX ZIP archive containing a xl/sharedStrings.xml file with an ISO-2022 encoded DOCTYPE declaration that defines recursive or external XML entities, bypassing the XmlScanner regex check.
2. Embed entity payload: Include a quadratic blowup entity definition (e.g., nested entity references that expand exponentially) or a SYSTEM entity pointing to a local file (e.g., /etc/passwd) or internal network resource for SSRF.
3. Upload to target: Submit the crafted XLSX file to any application endpoint that accepts spreadsheet uploads and processes them with PhpSpreadsheet (e.g., an import feature).
4. Trigger parsing: The application calls $reader->load('poc.xlsx'), which invokes XmlScanner::scan(). The ISO-2022 encoded DOCTYPE bypasses the scanner's regex, and libxml2 processes the malicious entities.
5. Achieve objective: For DoS, the entity expansion consumes server memory (~45 MB per 2 KB file); for file read (PHP < 8.0 / libxml2 < 2.9), the SYSTEM entity resolves and returns local file contents; for SSRF, the SYSTEM entity triggers an outbound HTTP request to an attacker-controlled or internal host (GitHub Advisory).

• Network: Unexpected outbound HTTP/FTP requests from the web server process to internal or external hosts during XLSX file processing (indicative of SSRF via SYSTEM entity).
• Logs: PHP error logs or application logs showing excessive memory usage or memory_limit exhaustion errors during spreadsheet parsing; repeated upload requests with small XLSX files causing disproportionate resource consumption.
• File System: Presence of small (~2 KB) XLSX files in upload directories that contain ISO-2022 encoded content or DOCTYPE declarations in xl/sharedStrings.xml or other XML components.
• Process: Web server worker processes consuming abnormally high memory (e.g., 45+ MB per upload request) or crashing due to out-of-memory conditions during PhpSpreadsheet load() calls (GitHub Advisory).

Upgrade PhpSpreadsheet to one of the patched versions: 1.30.7, 2.1.19, 2.4.8, 3.10.8, or 5.10.0, depending on the branch in use. No official configuration-based workaround is described in the advisory; upgrading is the recommended and primary remediation. As a defense-in-depth measure, applications should validate and restrict uploaded file types, enforce per-request memory limits, and consider sandboxing file parsing operations (GitHub Advisory).