PatchClock

PHP security digest · Packages

phpoffice/phpspreadsheet security advisories

3 advisories we have followed since September 2026, 3 of them critical or high, newest first. Each page says who is affected, which versions fix it and how to check your project.

  1. High 27 Oct 2026

    PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)

    Fixed in 5.10.0, 3.10.8, 2.4.8, 2.1.19 · CVE-2026-108359

  2. High 27 Oct 2026

    PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service

    Fixed in 5.10.0, 3.10.8, 2.4.8, 2.1.19 · CVE-2026-108358

  3. High 27 Oct 2026

    PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service

    Fixed in 5.10.0, 3.10.8 · CVE-2026-108357

Check your project in one command

Composer compares your composer.lock with the public advisory databases:

composer audit

It lists every installed package with a known advisory, including phpoffice/phpspreadsheet, and the version that fixes it.