[MEDIUM] PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading

PKSA-r15m-kszr-8n8q CVE-2026-108360 GHSA-2phh-27fw-q4gc

Affected version: <=1.30.6|>=2.0.0,<=2.1.18|>=2.2.0,<=2.4.7|>=3.3.0,<=3.10.7|>=4.0.0,<=5.9.0

Reported by:
GitHub

[HIGH] PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)

PKSA-dxd5-wy68-pq29 CVE-2026-108359 GHSA-j2w7-387v-m2rq

Affected version: <=1.30.6|>=2.0.0,<=2.1.18|>=2.2.0,<=2.4.7|>=3.3.0,<=3.10.7|>=4.0.0,<=5.9.0

Reported by:
GitHub

[HIGH] PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service

PKSA-96jv-mtjg-g2v8 CVE-2026-108358 GHSA-3x94-m842-937c

Affected version: <=1.30.6|>=2.0.0,<=2.1.18|>=2.2.0,<=2.4.7|>=3.3.0,<=3.10.7|>=4.0.0,<=5.9.0

Reported by:
GitHub

[HIGH] PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service

PKSA-zb3c-6qhx-m249 CVE-2026-108357 GHSA-rxj4-h86g-25gc

Affected version: >=3.3.0,<=3.10.7|>=4.0.0,<=5.9.0

Reported by:
GitHub