# CVE-2026-108357: PHPOffice PhpSpreadsheet XML entity expansion denial of service

Source: https://junglewise.ai/threats/cve-2026-108357-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2026-108357 · Severity: high · CVSS 4 · Published 2026-10-22

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. A flaw in XML processing allows attackers to send maliciously crafted spreadsheet files that trigger entity expansion attacks, potentially causing denial of service, unauthorized local file access, or server-side request forgery (SSRF) attacks. This affects versions 3.3.0 through 3.10.7 and 5.0.0 through 5.9.2.

Technologies: [phpoffice/phpspreadsheet (Packagist)](https://junglewise.ai/threats/technologies/phpoffice-phpspreadsheet), [Phpoffice Phpspreadsheet](https://junglewise.ai/threats/technologies/phpspreadsheet). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Phpoffice](https://junglewise.ai/threats/vendors/phpoffice).

## Quick answers

**Is CVE-2026-108357 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108357 being exploited in the wild.

**How severe is CVE-2026-108357?** High severity, with a CVSS score of 4, published 22 October 2026.

**Which products and versions are affected?** phpoffice/phpspreadsheet (Packagist) >= 4.0.0, <= 5.9.0, ECOSYSTEM:introduced=4.0.0,fixed=5.10.0; Phpoffice Phpspreadsheet 3.3.0 to 3.10.7, 5.0.0 to 5.9.2.

**Is there a fix for CVE-2026-108357?** Yes. phpoffice/phpspreadsheet (Packagist): upgrade to 5.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-108357 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-108357?** Check whether you run phpoffice/phpspreadsheet (Packagist) or Phpoffice Phpspreadsheet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- phpoffice/phpspreadsheet (Packagist): upgrade to 5.10.0 or later

  ```sh
  composer require phpoffice/phpspreadsheet:^5.10.0
  ```


## Technical details

The Reader\Xml component improperly handles XML entity decoding, where numeric entities are decoded only after DOCTYPE pattern checks. Double-encoded less-than characters bypass initial security checks, allowing unchecked DOCTYPE and entity declarations to reach SimpleXML parsing. This enables XML entity expansion (XXE) attacks and XXE-based SSRF/local file access, particularly on PHP before 8.0 or when LIBXML_NOENT is enabled.

## Affected products

- PHPOffice PhpSpreadsheet 3.3.0 to 3.10.7, 5.0.0 to 5.9.2

## Identifiers

- CVE-2026-108357
- GHSA-rxj4-h86g-25gc

## Timeline

- 2026-10-22: disclosed
- 2026-09-15: patched

## References

- [https://github.com/PHPOffice/PhpSpreadsheet/commit/89f455c133e1a7e2d4abfadc43ce29eb7450d781](https://github.com/PHPOffice/PhpSpreadsheet/commit/89f455c133e1a7e2d4abfadc43ce29eb7450d781)
- [https://github.com/PHPOffice/PhpSpreadsheet/commit/980b5c294493856f1a25754f1e8a1d2185b93738](https://github.com/PHPOffice/PhpSpreadsheet/commit/980b5c294493856f1a25754f1e8a1d2185b93738)

## Related threats

- [PHPOffice PhpSpreadsheet redirect validation bypass in external image loading](https://junglewise.ai/threats/cve-2026-108360-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing)
- [PhpSpreadsheet denial-of-service via unbounded row repetition](https://junglewise.ai/threats/cve-2026-108359-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing)
- [PhpSpreadsheet XmlScanner XML entity expansion denial of service](https://junglewise.ai/threats/cve-2026-108358-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing)
- [MediaWiki DataTransfer Extension uncontrolled resource consumption](https://junglewise.ai/threats/cve-2026-100242-dependency-on-vulnerable-third-party-component-and-uncontrolled)
- [PHPOffice PhpSpreadsheet denial of service via Gnumeric gzip expansion](https://junglewise.ai/threats/cve-2026-59932-phpoffice-phpspreadsheet-denial-of-service-via-gnumeric-gzip)