Skip to content
Threat Feed
Subscribe

Product

PhpSpreadsheet (>= 3.3.0, <= 3.10.7)

1 brief RSS
high advisory

PhpSpreadsheet: XmlScanner TOCTOU bypass leading to XXE and DoS (CVE-2026-108357)

A TOCTOU vulnerability in PhpSpreadsheet allows attackers to bypass XML security filters via double-encoded numeric entities, enabling XXE and Denial of Service attacks.

PhpSpreadsheet +1
1t 1c