PhpSpreadsheet: XmlScanner TOCTOU bypass leading to XXE and DoS (CVE-2026-108357)

PhpSpreadsheet contains a Time-of-Check Time-of-Use (TOCTOU) vulnerability (CVE-2026-108357) in its XmlScanner::scan() method. The scanner performs two sequential passes over input data, but the unentity() callback - which decodes HTML entities - executes after the security pattern check in both passes. By using double-encoded numeric entities (e.g., <), an attacker can hide <!DOCTYPE declarations from the security filter. The first pass decodes the entity into a single-encoded format, and the second pass completes the decoding, resulting in a malicious <!DOCTYPE payload that the XML parser then executes.

Attack Chain

1. Attacker crafts a malicious SpreadsheetML XML file containing double-encoded entities (e.g., < for <).
2. The Reader\Xml component passes the raw file content to XmlScanner::scan().
3. XmlScanner::scan() performs a pattern match on the raw input; the malicious <!DOCTYPE remains hidden.
4. The unentity() callback executes html_entity_decode(), converting the double-encoded entity to a single-encoded entity.
5. The partially decoded XML is stored in Xml::$fileContents.
6. The Xml reader initiates a second scan pass, which also fails to match the pattern because the entity is only partially decoded.
7. The unentity() callback executes again, converting the single-encoded entity into the raw < character.
8. simplexml_load_string() processes the final, now-malicious XML, triggering entity expansion (DoS) or XXE.

Impact

• Denial of Service: Exploitation causes quadratic memory blowup via entity expansion.
• Information Disclosure: XXE/SSRF allows unauthorized reading of local files or internal network resources, specifically on PHP versions < 8.0 or when LIBXML_NOENT is enabled.

Recommendation

• Upgrade PhpSpreadsheet to a patched version once available from PHPOffice.
• Audit applications that use PhpOffice\PhpSpreadsheet\Reader\Xml to identify intake points for user-supplied SpreadsheetML files.
• Implement file-type validation and strictly forbid LIBXML_NOENT if using older PHP environments.