GHSA-3X94-M842-937C PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service

Summary PhpSpreadsheet's XmlScanner::scan uses a regex pattern that only accounts for NULL byte 0x00 interleaving when detecting !DOCTYPE. ISO-2022 escape sequences 0x1B bytes inserted between the characters of the pattern break the regex match entirely, allowing DOCTYPE declarations with entity...

PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service

Summary PhpSpreadsheet's XmlScanner::scan uses a regex pattern that only accounts for NULL byte 0x00 interleaving when detecting !DOCTYPE. ISO-2022 escape sequences 0x1B bytes inserted between the characters of the pattern break the regex match entirely, allowing DOCTYPE declarations with entity...

EUVD-2026-108265

PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service...

PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service

Summary The SpreadsheetML XML reader Reader\Xml scans file content twice through XmlScanner::scan, and each scan runs an unentity callback that calls htmlentitydecode after the pattern check. By double-encoding the toUtf8$xml; if pregmatch$pattern, $xml // CHECK 2 UTF-8 throw new Exception'Detect...

GHSA-RXJ4-H86G-25GC PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service

Summary The SpreadsheetML XML reader Reader\Xml scans file content twice through XmlScanner::scan, and each scan runs an unentity callback that calls htmlentitydecode after the pattern check. By double-encoding the toUtf8$xml; if pregmatch$pattern, $xml // CHECK 2 UTF-8 throw new Exception'Detect...

CVE-2026-108358

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that accounts for NUL-byte interleaving but not ISO-2022 escap...

CVE-2026-108357 PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored SpreadsheetML XML through XmlScanner::scan in Xml::canRead and Xml::trySimpleXMLLoadStringPrivate, while Xml::unentity decodes numeric entities only after...

CVE-2026-108357

The PhpSpreadsheet library (versions 3.3.0 through 3.10.8 and 5.10.0) is vulnerable to an XmlScanner Bypass due to a Time-of-Check to Time-of-Use (TOCTOU) flaw in the Xml::unentity function. The root cause is that numeric entities are decoded after each DOCTYPE pattern check; a double-encoded les...

CVE-2026-108357 PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored SpreadsheetML XML through XmlScanner::scan in Xml::canRead and Xml::trySimpleXMLLoadStringPrivate, while Xml::unentity decodes numeric entities only after...

CVE-2026-108357 PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored SpreadsheetML XML through XmlScanner::scan in Xml::canRead and Xml::trySimpleXMLLoadStringPrivate, while Xml::unentity decodes numeric entities only after...

CVE-2026-108358 PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that accounts for NUL-byte interleaving but not ISO-2022 escap...

CVE-2026-108358

The PhpSpreadsheet library (prior to versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0) contains a vulnerability in XmlScanner::scan within src/PhpSpreadsheet/Reader/Security/XmlScanner.php. The scanner's DOCTYPE detection pattern fails to account for ISO-2022 escape sequences in XLSX XML parts....

CVE-2026-108358 PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that accounts for NUL-byte interleaving but not ISO-2022 escap...

CVE-2026-108358 PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that accounts for NUL-byte interleaving but not ISO-2022 escap...

CVE-2026-108358

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that accounts for NUL-byte interleaving but not ISO-2022 escap...

PT-2026-121480

Name of the Vulnerable Software and Affected Versions PhpSpreadsheet versions prior to 1.30.7 PhpSpreadsheet versions prior to 2.1.19 PhpSpreadsheet versions prior to 2.4.8 PhpSpreadsheet versions prior to 3.10.8 PhpSpreadsheet versions prior to 5.10.0 Description The XmlScanner::scan function in...

CLEANSTART-2026-UI56103 XMLscanner

Security vulnerability affects the apache-hive package. XMLscanner...

CLEANSTART-2026-OW18988 XMLScanner

Security vulnerability affects the apache-hive package. XMLScanner...

EUVD-2024-3279

Malicious code in bioql PyPI...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection via the scan method in the XmlScanner class. Exploiting this vulnerability is possible when using a UTF-7 encoded payload, including at the end of the file a comment with the value encoding="UTF-8" with...