CVE-2026-59933

This CVE is a cycle in the OLE file's sector chain that causes infinite loops during parsing, exhausting memory and hanging the PHP process. The vulnerability lives in PhpSpreadsheet's OLE reader and is reachable through Reader\Xls::canRead() — the auto-detection method that determines whether a given file is an XLS format. If your application uses PhpSpreadsheet's auto-detection on uploaded files (which is the default behavior when you let the library determine file type), this code path executes before any explicit user action flags the file as untrusted. The root cause is straightforward: the OLE reader implements the 'happy path' — reading linked sectors until it reaches an end-of-chain marker — without checking whether that marker will ever be reached. A crafted file with a circular sector reference creates an infinite loop. This isn't a subtle logic error; it's a missing sanity check that would be obvious if anyone had asked 'what happens if the chain never ends?' The fix involves either tracking visited sectors to detect cycles or capping the maximum chain length. The auto-detection reachability is the detail that makes this exploitable in practice. Modern PHP applications often use 'let me figure out what this is' logic for file uploads — a developer convenience that creates a silent attack surface. You don't need to explicitly call the XLS reader; you just need to let the library auto-detect the uploaded file's type. If your upload handling uses auto-detection, you're exposed without any explicit decision to trust XLS files. Patch versions 5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6 all contain the fix. Note that the 1.x branch has been end-of-life since 2023 — if you're pinned to ^1.30, there's no upstream patch coming and you need to upgrade to a supported branch or implement a workaround. For immediate mitigation: if you process uploaded spreadsheet files, disable auto-detection and explicitly specify the reader, or wrap file processing in resource limits (set_time_limit, memory_limit). For detection: scan your codebase for uses of Reader\Xls::canRead() or any auto-detection logic on untrusted uploads. For hardening: treat any file parsing library as network-facing code when it processes uploads — the same boundary enforcement applies.

Reviewed through automated stages and approved by a human before publication.