Key points
- CVE-2026-108359 is rated high severity with a CVSS score of 8.7.
- The vulnerability affects PhpSpreadsheet versions prior to specific patched releases.
- Attackers can exhaust CPU and memory by exploiting unbounded row repetition.
PhpSpreadsheet versions before 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0 contain a high-severity vulnerability. The flaw allows attackers to exhaust server resources through crafted ODS spreadsheet files. Patches are now available for all affected version branches. Small-business owners using this library to process user-uploaded spreadsheets should verify their current version immediately.
In plain English
The PhpSpreadsheet library reads and writes spreadsheet files in PHP. The vulnerability exists in how it handles ODS table rows. An attacker can create a small file that tells the reader to repeat a row many times. The library processes these repetitions without checking limits. This causes the server to use excessive CPU and memory. The PHP worker process terminates as a result. Column repetition is not affected by this issue.
The background
The National Vulnerability Database lists CVE-2026-108359 with a CVSS score of 8.7. This falls into the high severity category. The weaknesses are identified as CWE-400 and CWE-789. The issue occurs in the Ods::processTableRow function within the ODS reader. It accepts an unbounded table:number-rows-repeated attribute. When the row contains a value, the reader materializes cells for every repetition. This behavior bypasses standard spreadsheet row limits.
What changes now
Developers must update PhpSpreadsheet to the patched versions. Version 1.30.7 fixes the issue for the 1.x branch. Version 2.1.19 addresses the flaw in the 2.1 line. Version 2.4.8 resolves the problem for the 2.4 series. Version 3.10.8 patches the 3.x branch. Version 5.10.0 fixes the 5.x line. Users on older versions should migrate to these releases. No other mitigation has been confirmed by the vendor.
Who needs to act first
Teams usually prioritize systems that accept user-uploaded files. Check whether your application allows visitors to submit ODS documents. These systems face the highest exposure risk. Test the update in a staging environment first. Back up your current configuration before applying changes. Roll out the fix to production servers gradually. Monitor server resources during the update process. This approach reduces the chance of service disruption.
What to do and how to stay safe: PhpSpreadsheet
- Verify your current PhpSpreadsheet version against the affected list.
- Update to the latest patched version for your specific branch.
- Monitor server logs for unusual CPU or memory spikes.
- Restrict file uploads to trusted sources where possible.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of PhpSpreadsheet are vulnerable?
Versions prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0 are affected.
What is the severity of CVE-2026-108359?
It is rated high severity with a CVSS score of 8.7.
Can attackers exploit this via column repetition?
No, column repetition is separately bounded and not part of this vulnerability.
