Is CVE-2026-108357 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108357 being exploited in the wild.

How severe is CVE-2026-108357?

High severity, with a CVSS score of 4, published 22 October 2026.

Which products and versions are affected?

phpoffice/phpspreadsheet (Packagist) >= 4.0.0, <= 5.9.0, ECOSYSTEM:introduced=4.0.0,fixed=5.10.0; Phpoffice Phpspreadsheet 3.3.0 to 3.10.7, 5.0.0 to 5.9.2.

Is there a fix for CVE-2026-108357?

Yes. phpoffice/phpspreadsheet (Packagist): upgrade to 5.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-108357 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-108357?

Check whether you run phpoffice/phpspreadsheet (Packagist) or Phpoffice Phpspreadsheet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108357: PHPOffice PhpSpreadsheet XML entity expansion denial of service

Q: Is there a fix for CVE-2026-108357?

Yes. phpoffice/phpspreadsheet (Packagist): upgrade to 5.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-108357 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-108357?

Check whether you run phpoffice/phpspreadsheet (Packagist) or Phpoffice Phpspreadsheet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108357 · Severity: high · CVSS 4 · Published 2026-10-22

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. A flaw in XML processing allows attackers to send maliciously crafted spreadsheet files that trigger entity expansion attacks, potentially causing denial of service, unauthorized local file access, or server-side request forgery (SSRF) attacks. This affects versions 3.3.0 through 3.10.7 and 5.0.0 through 5.9.2.

Technologies: phpoffice/phpspreadsheet (Packagist), Phpoffice Phpspreadsheet. Vendors: Packagist, Phpoffice.

Quick answers

Is CVE-2026-108357 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108357 being exploited in the wild.
How severe is CVE-2026-108357?: High severity, with a CVSS score of 4, published 22 October 2026.
Which products and versions are affected?: phpoffice/phpspreadsheet (Packagist) >= 4.0.0, <= 5.9.0, ECOSYSTEM:introduced=4.0.0,fixed=5.10.0; Phpoffice Phpspreadsheet 3.3.0 to 3.10.7, 5.0.0 to 5.9.2.
Is there a fix for CVE-2026-108357?: Yes. phpoffice/phpspreadsheet (Packagist): upgrade to 5.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-108357 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-108357?: Check whether you run phpoffice/phpspreadsheet (Packagist) or Phpoffice Phpspreadsheet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

phpoffice/phpspreadsheet (Packagist): upgrade to 5.10.0 or later
```
composer require phpoffice/phpspreadsheet:^5.10.0
```

Technical details

The Reader\Xml component improperly handles XML entity decoding, where numeric entities are decoded only after DOCTYPE pattern checks. Double-encoded less-than characters bypass initial security checks, allowing unchecked DOCTYPE and entity declarations to reach SimpleXML parsing. This enables XML entity expansion (XXE) attacks and XXE-based SSRF/local file access, particularly on PHP before 8.0 or when LIBXML_NOENT is enabled.

Affected products

PHPOffice PhpSpreadsheet 3.3.0 to 3.10.7, 5.0.0 to 5.9.2

Identifiers

CVE-2026-108357
GHSA-rxj4-h86g-25gc

Timeline

2026-10-22: disclosed
2026-09-15: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.