Skip to content
Threat Feed
Subscribe

Product

PhpSpreadsheet (>= 4.0.0, <= 5.9.0)

1 brief RSS
high advisory

PhpSpreadsheet: XmlScanner TOCTOU bypass leading to XXE and DoS (CVE-2026-108357)

A TOCTOU vulnerability in PhpSpreadsheet allows attackers to bypass XML security filters via double-encoded numeric entities, enabling XXE and Denial of Service attacks.

PhpSpreadsheet +1
1t 1c