{"record":{"id":"3ad4579cb6da7e0e","repo":"PHPOffice/PhpSpreadsheet","slug":"utf-7-encoding-not-permitted","errorCode":null,"errorMessage":"UTF-7 encoding not permitted","messagePattern":"UTF-7 encoding not permitted","errorType":"exception","errorClass":"PhpOffice\\PhpSpreadsheet\\Reader\\Exception","httpStatus":null,"severity":"error","filePath":"src/PhpSpreadsheet/Reader/Security/XmlScanner.php","lineNumber":56,"sourceCode":"\n    private function toUtf8(string $xml): string\n    {\n        $charset = $this->findCharSet($xml);\n        $foundUtf7 = $charset === 'UTF-7';\n        if ($charset !== 'UTF-8') {\n            $testStart = '/^.{0,4}\\s*<?xml/s';\n            $startWithXml1 = preg_match($testStart, $xml);\n            $xml = self::forceString(mb_convert_encoding($xml, 'UTF-8', $charset));\n            if ($startWithXml1 === 1 && preg_match($testStart, $xml) !== 1) {\n                throw new Reader\\Exception('Double encoding not permitted');\n            }\n            $foundUtf7 = $foundUtf7 || (preg_match(self::ENCODING_UTF7, $xml) === 1);\n            $xml = preg_replace(self::ENCODING_PATTERN, '', $xml) ?? $xml;\n        } else {\n            $foundUtf7 = $foundUtf7 || (preg_match(self::ENCODING_UTF7, $xml) === 1);\n        }\n        if ($foundUtf7) {\n            throw new Reader\\Exception('UTF-7 encoding not permitted');\n        }\n        if (substr($xml, 0, Reader\\Csv::UTF8_BOM_LEN) === Reader\\Csv::UTF8_BOM) {\n            $xml = substr($xml, Reader\\Csv::UTF8_BOM_LEN);\n        }\n\n        return $xml;\n    }\n\n    private function findCharSet(string $xml): string\n    {\n        if (str_starts_with($xml, \"\\x4c\\x6f\\xa7\\x94\")) {\n            throw new Reader\\Exception('EBCDIC encoding not permitted');\n        }\n        $encoding = Reader\\Csv::guessEncodingBom('', $xml);\n        if ($encoding !== '') {\n            return $encoding;\n        }\n        $xml = str_replace(\"\\0\", '', $xml);","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/PHPOffice/PhpSpreadsheet/blob/65b080eef4d9fd11a5796135ab145883e5c3d6a6/src/PhpSpreadsheet/Reader/Security/XmlScanner.php#L38-L74","documentation":"Error \"UTF-7 encoding not permitted\" thrown in PHPOffice/PhpSpreadsheet.","triggerScenarios":"Thrown at src/PhpSpreadsheet/Reader/Security/XmlScanner.php:56 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"65b080eef4d9fd11a5796135ab145883e5c3d6a6","analyzedAt":"2026-08-17T05:40:41.646Z","schemaVersion":2},"datasetVersion":"2026-08-17T09:17:11.063Z"}