SB2026101343 - Multiple vulnerabilities in PhpSpreadsheet

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026101343

SB2026101343 - Multiple vulnerabilities in PhpSpreadsheet

Published: October 13, 2026

Security Bulletin ID SB2026101343
CSH Severity
High
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

High 25% Medium 50% Low 25%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) XML External Entity injection (CVE-ID: CVE-2026-108357)

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information, perform server-side request forgery, and cause a denial of service.

The vulnerability exists due to improper restriction of XML entity references in the SpreadsheetML XML reader's XmlScanner::scan() processing when decoding numeric character references after security checks during two successive scans. A remote attacker can submit a specially crafted SpreadsheetML XML file containing double-encoded document type and entity declarations to disclose sensitive information, perform server-side request forgery, and cause a denial of service.

External entity exploitation depends on the PHP and libxml configuration, including PHP versions earlier than 8.0 or use of LIBXML_NOENT. Internal entity expansion is exploitable on all PHP versions.


2) XML Entity Expansion (CVE-ID: CVE-2026-108358)

CWE-ID: CWE-776 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper restriction of XML entity expansion in XmlScanner::scan() when processing user-uploaded XLSX files. A remote attacker can submit a specially crafted XLSX file with ISO-2022 escape sequences inserted between characters of a DOCTYPE declaration to cause a denial of service.

Quadratic internal entity expansion is exploitable on all PHP versions and is not blocked by libxml2 2.9 or later defaults. The demonstrated file consumed approximately 45 MB of memory from an approximately 2 KB XLSX file.


3) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-108359)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to memory allocation with an unbounded row-repeat count in the Ods::processTableRow() function when processing user-supplied OpenDocument Spreadsheet files. A remote attacker can supply a specially crafted .ods file containing an excessive table:number-rows-repeated value to cause a denial of service.

No special configuration is required, and exploitation is possible with the default read filter.


4) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-108360)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N]


The vulnerability allows a remote user to perform blind server-side requests to internal endpoints.

n

The vulnerability exists due to improper validation of redirect destinations in PhpSpreadsheet's WorksheetDrawing::setPath() when loading external images from whitelisted URLs. A remote user can supply crafted XLSX or HTML content referencing a whitelisted URL that returns an HTTP redirect to an internal target to perform blind server-side requests to internal endpoints.

n

Exploitation requires external image loading to be enabled through setAllowExternalImages(true) and the initial URL to pass the configured whitelist callback. The fetched response body is not exposed; this is a blind GET primitive rather than a full response-read capability.


Remediation

Install update from vendor's website.

References