PhpSpreadsheet XML flaw allows SSRF and local file access in versions before 3.10.8

The National Vulnerability Database records CVE-2026-108357 as a high-severity flaw in the PhpSpreadsheet library. This pure PHP library is widely used for reading and writing spreadsheet files. The vulnerability exists in how the library processes SpreadsheetML XML inputs. Specifically, the Reader component fails to properly sanitize entity declarations before parsing. This oversight allows attackers to inject malicious content that the underlying PHP engine processes incorrectly.

How does the vulnerability work?

The issue stems from the order of operations in the Xml::unentity function. According to the NVD record, this function decodes numeric entities only after checking for DOCTYPE patterns. When an attacker provides a double-encoded less-than character, the first callback reduces it to another encoded character. The second callback then reduces it to a literal less-than sign. This sequence bypasses the initial safety checks.

Consequently, the SimpleXML parser receives an unchecked DOCTYPE and entity declaration. The NVD description notes that this allows processing of attacker-controlled SpreadsheetML XML. This can lead to entity-expansion denial of service attacks. In certain configurations, it also permits local file access or server-side request forgery.

Which environments are at risk?

The vulnerability affects PhpSpreadsheet versions 3.3.0 up to, but not including, 3.10.8. It also impacts versions 4.0.0 up to, but not including, 5.10.0. The NVD record confirms that versions 3.10.8 and 5.10.0 contain the fix. The severity of the exploit depends on the PHP version and configuration.

Local file access or SSRF is possible on PHP versions before 8.0. It is also possible when the LIBXML_NOENT flag is enabled in later PHP versions. Teams using older PHP runtimes or enabling this specific library flag face higher exposure. The weaknesses are classified as CWE-611 and CWE-776.

What are the potential impacts?

The primary impact is a denial of service through entity expansion. This consumes server resources. More severe impacts include unauthorized access to local files on the server. Attackers may also leverage server-side request forgery to interact with internal services.

The NVD rates the CVSS score at 8.8, which is considered high. This rating reflects the potential for significant system compromise. Applications that accept user-uploaded spreadsheet files are particularly vulnerable. If these files are processed by the affected PhpSpreadsheet versions, the system is exposed to the described risks.

What is the remediation path?

The vendor has released patches for the affected versions. Users should update to PhpSpreadsheet version 3.10.8 or 5.10.0. These versions include the necessary fixes to properly sanitize XML inputs. Teams should verify their current library version against the affected range.

If immediate updating is not possible, teams should consider restricting file uploads. Disabling the LIBXML_NOENT flag may mitigate some risks on newer PHP versions. However, upgrading the library remains the most effective solution. The NVD record confirms the fix is present in the specified versions.

Detection notes

Teams usually monitor for unusual spikes in CPU or memory usage, which can indicate entity expansion attacks. Check web server logs for requests containing complex XML structures or unexpected file paths. Look for errors related to SimpleXML parsing failures in application logs. Investigate any outbound connections to internal IP addresses that do not match normal traffic patterns. Review access logs for attempts to read sensitive system files. Containment often involves temporarily disabling file upload features or blocking suspicious user agents.

Background: National Vulnerability Database

The National Vulnerability Database is the U.S. government’s repository of security flaws in software and hardware. It assigns unique identifiers to each issue, allowing organizations to track, prioritize, and remediate risks using standardized references rather than vague descriptions.

Read the full guide: National Vulnerability Database: Meaning, Structure, and Daily Use

What to do and how to stay safe: PhpSpreadsheet

• Audit your applications to identify any use of PhpSpreadsheet versions 3.3.0 through 3.10.8 or 4.0.0 through 5.10.0.
• Update to PhpSpreadsheet version 3.10.8 or 5.10.0 to apply the vendor-provided fix for CVE-2026-108357.
• Monitor server logs for signs of XML parsing errors or unexpected file access attempts following an upload.
• Review PHP configurations to ensure LIBXML_NOENT is not enabled unless absolutely necessary for business operations.

Step-by-step guide: Patch Management Checklist: Secure Systems Without Breaking Them

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-108357?

The National Vulnerability Database rates the severity at 8.8, which is classified as high.

Which PhpSpreadsheet versions are affected by this flaw?

Versions 3.3.0 to 3.10.8 and 4.0.0 to 5.10.0 are affected. Versions 3.10.8 and 5.10.0 are fixed.

Can this vulnerability lead to remote code execution?

The source material states it can permit local file access or SSRF, but does not mention remote code execution.