[HIGH] PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service

PKSA-zb3c-6qhx-m249 CVE-2026-108357 GHSA-rxj4-h86g-25gc

Affected package: phpoffice/phpspreadsheet

Affected version: >=3.3.0,<=3.10.7|>=4.0.0,<=5.9.0

Reported by:
GitHub