Threats tagged 'ghsa-rxj4-h86g-25gc'

PhpSpreadsheet's XmlScanner performs two scans on XML content, each followed by an entity decoding callback that runs after pattern checks. This allows a double-encoded entity sequence to bypass detection of dangerous <!DOCTYPE declarations, enabling XML External Entity (XXE) injection and Denial of Service (DoS) via entity expansion. The vulnerability affects PhpSpreadsheet versions >=3.3.0 <3.10.8 and >=4.0.0 <5.10.0. It is exploitable for DoS on all PHP versions and for XXE/SSRF on PHP versions below 8.0 or when LIBXML_NOENT is used. Fixed in versions 3.10.8 and 5.10.0.