[HIGH] PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service

PKSA-96jv-mtjg-g2v8 CVE-2026-108358 GHSA-3x94-m842-937c

Affected package: phpoffice/phpspreadsheet

Affected version: <=1.30.6|>=2.0.0,<=2.1.18|>=2.2.0,<=2.4.7|>=3.3.0,<=3.10.7|>=4.0.0,<=5.9.0

Reported by:
GitHub