PHPOffice PhpSpreadsheet: XmlScanner bypass allows XXE and DoS (CVE-2026-108358)

The XmlScanner::scan() method in PhpSpreadsheet utilizes an insufficient regular expression that only handles NULL byte (0x00) interleaving to detect <!DOCTYPE declarations. An attacker can bypass this filter by inserting ISO-2022 escape sequences (0x1B bytes) between the characters of the DOCTYPE tag. Because the XML parser performs charset normalization and strips these bytes before processing, the resulting XML becomes a valid document with an injected DOCTYPE that was never validated. This allows for Denial of Service through quadratic entity expansion on all PHP versions, and XXE or SSRF on systems running PHP < 8.0 or those configured with LIBXML_NOENT.

Attack Chain

1. Attacker crafts a malicious XLSX archive file containing a specially encoded XML part (e.g., sharedStrings.xml).
2. Attacker embeds <!DOCTYPE tags within the XML using ISO-2022 escape sequences (e.g., ESC ( B) to obfuscate characters.
3. Attacker uploads the file to the target application using PhpSpreadsheet.
4. The application triggers PhpSpreadsheet\Reader\Security\XmlScanner::scan() on the uploaded file.
5. The XmlScanner regex fails to identify the obfuscated DOCTYPE due to the presence of escape sequences.
6. The SimpleXML loader processes the XML and performs charset normalization, stripping the escape sequences and revealing the DOCTYPE.
7. The XML parser processes the DOCTYPE, leading to entity expansion (DoS) or file/network access (XXE/SSRF).

Impact

Successful exploitation can cause significant resource exhaustion (DoS) via memory-intensive entity expansion. In environments with older PHP versions or specific XML configuration, it facilitates information disclosure and server-side request forgery. A 2 KB malicious XLSX file can result in ~45 MB of peak memory usage.

Recommendation

1. Update PhpSpreadsheet to the latest patched version immediately.
2. Implement strict file validation for user-uploaded XLSX files to ensure they conform to expected schemas before processing.
3. Limit memory_limit for scripts that process user-supplied spreadsheet files to mitigate the impact of quadratic entity expansion.
4. Ensure libxml_disable_entity_loader(true) is explicitly set if using older PHP environments where this is not default.