CVE-2026-108358: CWE-611: Improper Restriction of XML External Entity Reference in PHPOffice PhpSpreadsheet

PhpSpreadsheet versions prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0 contain a vulnerability in the XmlScanner::scan function where the DOCTYPE detection pattern does not account for ISO-2022 escape sequences in XLSX XML parts. These escape sequences prevent the scanner from recognizing the DOCTYPE declaration, and subsequent XML charset normalization removes the escape bytes, exposing valid DOCTYPE and entity definitions. An attacker can craft XLSX files that exploit this to cause entity expansion denial of service on supported PHP versions, and potentially local file access or SSRF on PHP versions before 8.0 or when LIBXML_NOENT is enabled. The issue is addressed by updates in the fixed versions.

Exploitation of this vulnerability can lead to denial of service through entity expansion attacks, local file access, or server-side request forgery (SSRF) depending on the PHP environment and configuration. This can compromise system availability and confidentiality by allowing attackers to read local files or make unauthorized network requests. The vulnerability affects PHP versions before 8.0 or configurations where LIBXML_NOENT is enabled.

This vulnerability is fixed in PhpSpreadsheet versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0. Users should upgrade to these or later versions to remediate the issue. No additional mitigation steps are indicated beyond applying the official fixes.