CVE-2026-108357: CWE-611: Improper Restriction of XML External Entity Reference in PHPOffice PhpSpreadsheet

PhpSpreadsheet versions >=3.3.0 <3.10.8 and >=4.0.0 <5.10.0 improperly handle XML External Entity references due to the way the Reader\Xml component processes SpreadsheetML XML. Specifically, the XmlScanner::scan method in Xml::canRead and Xml::trySimpleXMLLoadStringPrivate allows a double-encoded less-than character to bypass DOCTYPE and entity declaration checks, resulting in SimpleXML receiving unchecked DOCTYPE and entity declarations. This flaw can lead to entity-expansion denial of service and enable local file access or SSRF on PHP versions before 8.0 or when the LIBXML_NOENT option is enabled. The vulnerability is addressed in PhpSpreadsheet versions 3.10.8 and 5.10.0.

An attacker who can supply malicious SpreadsheetML XML to the vulnerable PhpSpreadsheet versions may cause denial of service through entity expansion or exploit the XXE flaw to access local files or perform SSRF attacks. This risk is present on PHP versions prior to 8.0 or when the LIBXML_NOENT option is enabled. The vulnerability has a high severity rating with a CVSS 4.0 score of 8.8.

Upgrade PhpSpreadsheet to version 3.10.8 or later, or 5.10.0 or later, where this vulnerability is fixed. No other mitigations are specified. Patch status is confirmed fixed in these versions.