{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-108358/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-108358"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PhpSpreadsheet (\u003c= 1.30.6)","PhpSpreadsheet (2.0.0-2.1.18)","PhpSpreadsheet (2.2.0-2.4.7)","PhpSpreadsheet (3.3.0-3.10.7)","PhpSpreadsheet (4.0.0-5.9.0)"],"_cs_severities":["high"],"_cs_tags":["xxe","dos","php","xml","cve-2026-108358"],"_cs_type":"advisory","_cs_vendors":["PHPOffice"],"content_html":"\u003cp\u003eThe \u003ccode\u003eXmlScanner::scan()\u003c/code\u003e method in PhpSpreadsheet utilizes an insufficient regular expression that only handles NULL byte (0x00) interleaving to detect \u003ccode\u003e\u0026lt;!DOCTYPE\u003c/code\u003e declarations. An attacker can bypass this filter by inserting ISO-2022 escape sequences (0x1B bytes) between the characters of the \u003ccode\u003eDOCTYPE\u003c/code\u003e tag. Because the XML parser performs charset normalization and strips these bytes before processing, the resulting XML becomes a valid document with an injected \u003ccode\u003eDOCTYPE\u003c/code\u003e that was never validated. This allows for Denial of Service through quadratic entity expansion on all PHP versions, and XXE or SSRF on systems running PHP \u0026lt; 8.0 or those configured with \u003ccode\u003eLIBXML_NOENT\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker crafts a malicious XLSX archive file containing a specially encoded XML part (e.g., \u003ccode\u003esharedStrings.xml\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eAttacker embeds \u003ccode\u003e\u0026lt;!DOCTYPE\u003c/code\u003e tags within the XML using ISO-2022 escape sequences (e.g., \u003ccode\u003eESC ( B\u003c/code\u003e) to obfuscate characters.\u003c/li\u003e\n\u003cli\u003eAttacker uploads the file to the target application using PhpSpreadsheet.\u003c/li\u003e\n\u003cli\u003eThe application triggers \u003ccode\u003ePhpSpreadsheet\\Reader\\Security\\XmlScanner::scan()\u003c/code\u003e on the uploaded file.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eXmlScanner\u003c/code\u003e regex fails to identify the obfuscated \u003ccode\u003eDOCTYPE\u003c/code\u003e due to the presence of escape sequences.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eSimpleXML\u003c/code\u003e loader processes the XML and performs charset normalization, stripping the escape sequences and revealing the \u003ccode\u003eDOCTYPE\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe XML parser processes the \u003ccode\u003eDOCTYPE\u003c/code\u003e, leading to entity expansion (DoS) or file/network access (XXE/SSRF).\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation can cause significant resource exhaustion (DoS) via memory-intensive entity expansion. In environments with older PHP versions or specific XML configuration, it facilitates information disclosure and server-side request forgery. A 2 KB malicious XLSX file can result in ~45 MB of peak memory usage.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpdate PhpSpreadsheet to the latest patched version immediately.\u003c/li\u003e\n\u003cli\u003eImplement strict file validation for user-uploaded XLSX files to ensure they conform to expected schemas before processing.\u003c/li\u003e\n\u003cli\u003eLimit memory_limit for scripts that process user-supplied spreadsheet files to mitigate the impact of quadratic entity expansion.\u003c/li\u003e\n\u003cli\u003eEnsure \u003ccode\u003elibxml_disable_entity_loader(true)\u003c/code\u003e is explicitly set if using older PHP environments where this is not default.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-11-05T13:44:30Z","date_published":"2026-11-05T13:44:30Z","id":"https://feed.craftedsignal.io/briefs/2026-11-phpspreadsheet-xxe-bypass/","summary":"An XML parsing bypass in PhpSpreadsheet allows attackers to use ISO-2022 escape sequences to evade security filters, leading to potential DoS via entity expansion or XXE/SSRF depending on configuration.","title":"PHPOffice PhpSpreadsheet: XmlScanner bypass allows XXE and DoS (CVE-2026-108358)","url":"https://feed.craftedsignal.io/briefs/2026-11-phpspreadsheet-xxe-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-108358","version":"https://jsonfeed.org/version/1.1"}