CVE-2026-108358 | PHPOffice PhpSpreadsheet up to 5.9.x Xml Scanner XmlScanner.php XmlScanner::scan server-side request forgery

October 22, 2026 Yanac

A vulnerability was found in PHPOffice PhpSpreadsheet up to 1.30.6/2.1.18/2.4.7/3.10.7/5.9.x. It has been declared as problematic. This vulnerability affects the function XmlScanner::scan of the file src/PhpSpreadsheet/Reader/Security/XmlScanner.php of the component Xml Scanner. The manipulation results in server-side request forgery.

This vulnerability is known as CVE-2026-108358. It is possible to launch the attack remotely. No exploit is available.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More