Skip to content
Threat Feed
Subscribe

Product

PhpSpreadsheet (4.0.0-5.9.0)

1 brief RSS
high advisory

PHPOffice PhpSpreadsheet: XmlScanner bypass allows XXE and DoS (CVE-2026-108358)

An XML parsing bypass in PhpSpreadsheet allows attackers to use ISO-2022 escape sequences to evade security filters, leading to potential DoS via entity expansion or XXE/SSRF depending on configuration.

PhpSpreadsheet +4 xxe dos php xml cve-2026-108358
1t 1c