CVE-2026-108357

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored SpreadsheetML XML through XmlScanner::scan in Xml::canRead and Xml::trySimpleXMLLoadStringPrivate, while Xml::unentity decodes numeric entities only after each DOCTYPE pattern check. A double-encoded less-than character is reduced by the first callback to another encoded character and by the second callback to a literal less-than sign, so SimpleXML receives an unchecked DOCTYPE and entity declaration. Processing attacker-controlled SpreadsheetML XML can cause entity-expansion denial of service and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 3.10.8 and 5.10.0.

• CWE-611
• CWE-776

• https://github.com/PHPOffice/PhpSpreadsheet/commit/89f455c133e1a7e2d4abfadc43ce29eb7450d781
• https://github.com/PHPOffice/PhpSpreadsheet/commit/980b5c294493856f1a25754f1e8a1d2185b93738
• https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.8
• https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.10.0
• https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-rxj4-h86g-25gc

Published

Oct 22, 2026

Last Modified

Oct 23, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-108334A flaw was found in the internal WebAssembly (WASM) shim use…7.4
• CVE-2026-108335When the password reset functionality is enabled, and email …9.1
• CVE-2026-108336When the default self-signed certificate is used, an attacke…9.1
• CVE-2026-108337An administrator could retrieve the password reset code for …7.4
• CVE-2026-10834The WP Travel Engine WordPress plugin before 6.8.1 does not…4.6
• CVE-2026-10835The SALESmanago & Leadoo WordPress plugin before 3.11.3 does…7.7
• CVE-2026-108358PhpSpreadsheet is a pure PHP library for reading and writing…8.8
• CVE-2026-108359PhpSpreadsheet is a pure PHP library for reading and writing…8.7
• CVE-2026-10836Improper handling of HTTP headers that allows a remote attac…5.1
• CVE-2026-108360PhpSpreadsheet is a pure PHP library for reading and writing…6.4
• CVE-2026-108361Privasys Remote Attestation TLS Clients provides multi-langu…7.2
• CVE-2026-108362Privasys Remote Attestation TLS Clients provides multi-langu…9.1