CVE-2026-108357 | PHPOffice PhpSpreadsheet up to 3.10.7/5.9.x Xml Scanner XmlScanner::scan server-side request forgery

October 22, 2026 Yanac

A vulnerability classified as problematic has been found in PHPOffice PhpSpreadsheet up to 3.10.7/5.9.x. Affected is the function XmlScanner::scan of the component Xml Scanner. This manipulation causes server-side request forgery.

This vulnerability is tracked as CVE-2026-108357. The attack is possible to be carried out remotely. No exploit exists.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More