GHSA-RXJ4-H86G-25GC PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service

Summary The SpreadsheetML XML reader Reader\Xml scans file content twice through XmlScanner::scan, and each scan runs an unentity callback that calls htmlentitydecode after the pattern check. By double-encoding the toUtf8$xml; if pregmatch$pattern, $xml // CHECK 2 UTF-8 throw new Exception'Detect...