Is CVE-2026-108358 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108358 being exploited in the wild.

How severe is CVE-2026-108358?

High severity, with a CVSS score of 4, published 22 October 2026.

Which products and versions are affected?

phpoffice/phpspreadsheet (Packagist) >= 4.0.0, <= 5.9.0, ECOSYSTEM:introduced=4.0.0,fixed=5.10.0; Phpoffice Phpspreadsheet before 1.30.7, 2.1.19, 2.4.8, 3.10.8, 5.10.0.

Is there a fix for CVE-2026-108358?

Yes. phpoffice/phpspreadsheet (Packagist): upgrade to 5.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-108358 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-108358?

Check whether you run phpoffice/phpspreadsheet (Packagist) or Phpoffice Phpspreadsheet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108358: PhpSpreadsheet XmlScanner XML entity expansion denial of service

Q: Is there a fix for CVE-2026-108358?

Yes. phpoffice/phpspreadsheet (Packagist): upgrade to 5.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-108358 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-108358?

Check whether you run phpoffice/phpspreadsheet (Packagist) or Phpoffice Phpspreadsheet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108358 · Severity: high · CVSS 4 · Published 2026-10-22

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. When processing attacker-controlled XLSX files, a flaw in DOCTYPE detection allows XML entity expansion attacks that can cause denial of service, or on older PHP versions enable local file access and server-side request forgery.

Technologies: phpoffice/phpspreadsheet (Packagist), Phpoffice Phpspreadsheet. Vendors: Packagist, Phpoffice.

Quick answers

Is CVE-2026-108358 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108358 being exploited in the wild.
How severe is CVE-2026-108358?: High severity, with a CVSS score of 4, published 22 October 2026.
Which products and versions are affected?: phpoffice/phpspreadsheet (Packagist) >= 4.0.0, <= 5.9.0, ECOSYSTEM:introduced=4.0.0,fixed=5.10.0; Phpoffice Phpspreadsheet before 1.30.7, 2.1.19, 2.4.8, 3.10.8, 5.10.0.
Is there a fix for CVE-2026-108358?: Yes. phpoffice/phpspreadsheet (Packagist): upgrade to 5.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-108358 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-108358?: Check whether you run phpoffice/phpspreadsheet (Packagist) or Phpoffice Phpspreadsheet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

phpoffice/phpspreadsheet (Packagist): upgrade to 5.10.0 or later
```
composer require phpoffice/phpspreadsheet:^5.10.0
```

Technical details

The XmlScanner::scan method fails to detect DOCTYPE declarations when they are obfuscated with ISO-2022 escape sequences, despite accounting for NUL-byte interleaving. After XML charset normalization removes the escape bytes, the DOCTYPE and entity definitions become valid, permitting entity expansion. On PHP versions before 8.0 or when LIBXML_NOENT is enabled, attackers can read local files or trigger SSRF.

Affected products

PHPOffice PhpSpreadsheet before 1.30.7, 2.1.19, 2.4.8, 3.10.8, 5.10.0

Identifiers

CVE-2026-108358
GHSA-3x94-m842-937c

Timeline

2026-10-22: disclosed
2026-09-15: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.