{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/phpspreadsheet--4.0.0--5.9.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-108357"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PhpSpreadsheet (\u003e= 4.0.0, \u003c= 5.9.0)","PhpSpreadsheet (\u003e= 3.3.0, \u003c= 3.10.7)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["PHPOffice"],"content_html":"\u003cp\u003ePhpSpreadsheet contains a Time-of-Check Time-of-Use (TOCTOU) vulnerability (CVE-2026-108357) in its \u003ccode\u003eXmlScanner::scan()\u003c/code\u003e method. The scanner performs two sequential passes over input data, but the \u003ccode\u003eunentity()\u003c/code\u003e callback - which decodes HTML entities - executes \u003cem\u003eafter\u003c/em\u003e the security pattern check in both passes. By using double-encoded numeric entities (e.g., \u003ccode\u003e\u0026amp;#38;#60;\u003c/code\u003e), an attacker can hide \u003ccode\u003e\u0026lt;!DOCTYPE\u003c/code\u003e declarations from the security filter. The first pass decodes the entity into a single-encoded format, and the second pass completes the decoding, resulting in a malicious \u003ccode\u003e\u0026lt;!DOCTYPE\u003c/code\u003e payload that the XML parser then executes.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker crafts a malicious SpreadsheetML XML file containing double-encoded entities (e.g., \u003ccode\u003e\u0026amp;#38;#60;\u003c/code\u003e for \u003ccode\u003e\u0026lt;\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eReader\\Xml\u003c/code\u003e component passes the raw file content to \u003ccode\u003eXmlScanner::scan()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eXmlScanner::scan()\u003c/code\u003e performs a pattern match on the raw input; the malicious \u003ccode\u003e\u0026lt;!DOCTYPE\u003c/code\u003e remains hidden.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eunentity()\u003c/code\u003e callback executes \u003ccode\u003ehtml_entity_decode()\u003c/code\u003e, converting the double-encoded entity to a single-encoded entity.\u003c/li\u003e\n\u003cli\u003eThe partially decoded XML is stored in \u003ccode\u003eXml::$fileContents\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eXml\u003c/code\u003e reader initiates a second scan pass, which also fails to match the pattern because the entity is only partially decoded.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eunentity()\u003c/code\u003e callback executes again, converting the single-encoded entity into the raw \u003ccode\u003e\u0026lt;\u003c/code\u003e character.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003esimplexml_load_string()\u003c/code\u003e processes the final, now-malicious XML, triggering entity expansion (DoS) or XXE.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eDenial of Service:\u003c/strong\u003e Exploitation causes quadratic memory blowup via entity expansion.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eInformation Disclosure:\u003c/strong\u003e XXE/SSRF allows unauthorized reading of local files or internal network resources, specifically on PHP versions \u0026lt; 8.0 or when \u003ccode\u003eLIBXML_NOENT\u003c/code\u003e is enabled.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade PhpSpreadsheet to a patched version once available from PHPOffice.\u003c/li\u003e\n\u003cli\u003eAudit applications that use \u003ccode\u003ePhpOffice\\PhpSpreadsheet\\Reader\\Xml\u003c/code\u003e to identify intake points for user-supplied SpreadsheetML files.\u003c/li\u003e\n\u003cli\u003eImplement file-type validation and strictly forbid \u003ccode\u003eLIBXML_NOENT\u003c/code\u003e if using older PHP environments.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-01T20:48:33Z","date_published":"2026-11-01T20:48:33Z","id":"https://feed.craftedsignal.io/briefs/2026-11-phpspreadsheet-xxe-dos/","summary":"A TOCTOU vulnerability in PhpSpreadsheet allows attackers to bypass XML security filters via double-encoded numeric entities, enabling XXE and Denial of Service attacks.","title":"PhpSpreadsheet: XmlScanner TOCTOU bypass leading to XXE and DoS (CVE-2026-108357)","url":"https://feed.craftedsignal.io/briefs/2026-11-phpspreadsheet-xxe-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - PhpSpreadsheet (\u003e= 4.0.0, \u003c= 5.9.0)","version":"https://jsonfeed.org/version/1.1"}