# CVE-2026-108358: PhpSpreadsheet XmlScanner XML entity expansion denial of service

Source: https://junglewise.ai/threats/cve-2026-108358-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2026-108358 · Severity: high · CVSS 4 · Published 2026-10-22

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. When processing attacker-controlled XLSX files, a flaw in DOCTYPE detection allows XML entity expansion attacks that can cause denial of service, or on older PHP versions enable local file access and server-side request forgery.

Technologies: [phpoffice/phpspreadsheet (Packagist)](https://junglewise.ai/threats/technologies/phpoffice-phpspreadsheet), [Phpoffice Phpspreadsheet](https://junglewise.ai/threats/technologies/phpspreadsheet). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Phpoffice](https://junglewise.ai/threats/vendors/phpoffice).

## Quick answers

**Is CVE-2026-108358 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108358 being exploited in the wild.

**How severe is CVE-2026-108358?** High severity, with a CVSS score of 4, published 22 October 2026.

**Which products and versions are affected?** phpoffice/phpspreadsheet (Packagist) >= 4.0.0, <= 5.9.0, ECOSYSTEM:introduced=4.0.0,fixed=5.10.0; Phpoffice Phpspreadsheet before 1.30.7, 2.1.19, 2.4.8, 3.10.8, 5.10.0.

**Is there a fix for CVE-2026-108358?** Yes. phpoffice/phpspreadsheet (Packagist): upgrade to 5.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-108358 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-108358?** Check whether you run phpoffice/phpspreadsheet (Packagist) or Phpoffice Phpspreadsheet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- phpoffice/phpspreadsheet (Packagist): upgrade to 5.10.0 or later

  ```sh
  composer require phpoffice/phpspreadsheet:^5.10.0
  ```


## Technical details

The XmlScanner::scan method fails to detect DOCTYPE declarations when they are obfuscated with ISO-2022 escape sequences, despite accounting for NUL-byte interleaving. After XML charset normalization removes the escape bytes, the DOCTYPE and entity definitions become valid, permitting entity expansion. On PHP versions before 8.0 or when LIBXML_NOENT is enabled, attackers can read local files or trigger SSRF.

## Affected products

- PHPOffice PhpSpreadsheet before 1.30.7, 2.1.19, 2.4.8, 3.10.8, 5.10.0

## Identifiers

- CVE-2026-108358
- GHSA-3x94-m842-937c

## Timeline

- 2026-10-22: disclosed
- 2026-09-15: patched

## References

- [https://github.com/PHPOffice/PhpSpreadsheet/commit/299993894dce37aa3b64aa23e9a3f4bb77ab0e66](https://github.com/PHPOffice/PhpSpreadsheet/commit/299993894dce37aa3b64aa23e9a3f4bb77ab0e66)
- [https://github.com/PHPOffice/PhpSpreadsheet/commit/89f455c133e1a7e2d4abfadc43ce29eb7450d781](https://github.com/PHPOffice/PhpSpreadsheet/commit/89f455c133e1a7e2d4abfadc43ce29eb7450d781)

## Related threats

- [PHPOffice PhpSpreadsheet redirect validation bypass in external image loading](https://junglewise.ai/threats/cve-2026-108360-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing)
- [PhpSpreadsheet denial-of-service via unbounded row repetition](https://junglewise.ai/threats/cve-2026-108359-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing)
- [PHPOffice PhpSpreadsheet XML entity expansion denial of service](https://junglewise.ai/threats/cve-2026-108357-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing)
- [MediaWiki DataTransfer Extension uncontrolled resource consumption](https://junglewise.ai/threats/cve-2026-100242-dependency-on-vulnerable-third-party-component-and-uncontrolled)
- [PHPOffice PhpSpreadsheet denial of service via Gnumeric gzip expansion](https://junglewise.ai/threats/cve-2026-59932-phpoffice-phpspreadsheet-denial-of-service-via-gnumeric-gzip)