{"id":"ghsa-ghsa-rxj4-h86g-25gc","seq":1708786,"kind":"advisory","title":"PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service","url":"https://github.com/advisories/GHSA-rxj4-h86g-25gc","permalink":"https://vulnpulse.app/items/ghsa-ghsa-rxj4-h86g-25gc","summary":"影響: composer:phpoffice/phpspreadsheet >= 4.0.0, <= 5.9.0 → 5.10.0, composer:phpoffice/phpspreadsheet >= 3.3.0, <= 3.10.7 → 3.10.8\nThe SpreadsheetML XML reader (Reader\\Xml) scans file content twice through XmlScanner::scan(), and each scan runs an unentity() callback that calls html_entity_decode() after the pattern check. By double-encoding the toUtf8($xml); if (preg_match($pattern, $xml)) { // CHECK 2 (UTF-8) throw new Exception('Detected use of ENTITY...'); } if ($this->callback !== null) { $xml = call_user_func($this->callback, $xml); // DECODE (after checks!) } return $xml; // getSecurityScannerOrThrow()->scan($data);…","severity":"high","techs":["php"],"cves":["CVE-2026-108357"],"tags":["GHSA-rxj4-h86g-25gc","phpoffice/phpspreadsheet","phpoffice/phpspreadsheet"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T15:38:22.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}