PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service
High · fetched 2026-10-27
### Summary PhpSpreadsheet's `XmlScanner::scan()` uses a regex pattern that only accounts for NULL byte (0x00) interleaving when detecting `<!DOCTYPE`. ISO-2022 escape sequences (0x1B bytes) inserted between the characters of the pattern break the regex match entirely, allowing DOCTYPE declarations with entity definitions to pass through undetected. This enables Denial of Service via quadratic entity expansion on **all PHP versions**, and XXE/SSRF on PHP < 8.0 or when `LIBXML_NOENT` is used. Any application using PhpSpreadsheet to process user-uploaded XLSX files is affected.
Remediation
Upgrade phpoffice/phpspreadsheet to 5.10.0 or later. Upgrade phpoffice/phpspreadsheet to 3.10.8 or later. Upgrade phpoffice/phpspreadsheet to 2.4.8 or later.
Affected PHP branches
See the source advisory.
Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-27T12:20:12-04:00 · https://github.com/advisories/GHSA-3x94-m842-937c