PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service

High · fetched 2026-10-27

### Summary The SpreadsheetML XML reader (`Reader\Xml`) scans file content **twice** through `XmlScanner::scan()`, and each scan runs an `unentity()` callback that calls `html_entity_decode()` **after** the pattern check. By double-encoding the `<` character as `&#60;`, the first scan decodes `&` to `&` (forming `<`), and the second scan decodes `<` to `<` (forming `<!DOCTYPE`). Neither scan's pattern check detects the `<!DOCTYPE` string because the callback runs after each check.

Remediation

Upgrade phpoffice/phpspreadsheet to 5.10.0 or later. Upgrade phpoffice/phpspreadsheet to 3.10.8 or later.

Affected PHP branches

See the source advisory.

Check your site

Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-27T12:20:12-04:00 · https://github.com/advisories/GHSA-rxj4-h86g-25gc

← All threats