{"record":{"id":"3b51f0576fc7e74a","repo":"PHPOffice/PhpSpreadsheet","slug":"detected-use-of-entity-in-xml-spreadsheet-file-lo","errorCode":null,"errorMessage":"Detected use of ENTITY in XML, spreadsheet file load() aborted to prevent XXE/XEE attacks","messagePattern":"Detected use of ENTITY in XML, spreadsheet file load\\(\\) aborted to prevent XXE/XEE attacks","errorType":"exception","errorClass":"PhpOffice\\PhpSpreadsheet\\Reader\\Exception","httpStatus":null,"severity":"error","filePath":"src/PhpSpreadsheet/Reader/Security/XmlScanner.php","lineNumber":94,"sourceCode":"            return strtoupper($matches[2]);\n        }\n\n        return 'UTF-8';\n    }\n\n    /**\n     * Scan the XML for use of <!ENTITY to prevent XXE/XEE attacks.\n     *\n     * @param false|string $xml\n     */\n    public function scan($xml): string\n    {\n        // Don't rely purely on libxml_disable_entity_loader()\n        $pattern = '/\\0*' . implode('\\0*', mb_str_split($this->pattern, 1, 'UTF-8')) . '\\0*/';\n\n        $xml = \"$xml\";\n        if (preg_match($pattern, $xml)) {\n            throw new Reader\\Exception('Detected use of ENTITY in XML, spreadsheet file load() aborted to prevent XXE/XEE attacks');\n        }\n\n        $xml = $this->toUtf8($xml);\n        if (preg_match($pattern, $xml)) {\n            throw new Reader\\Exception('Detected use of ENTITY in XML, spreadsheet file load() aborted to prevent XXE/XEE attacks');\n        }\n\n        if ($this->callback !== null) {\n            $xml = call_user_func($this->callback, $xml);\n        }\n        /** @var string $xml */\n\n        return $xml;\n    }\n\n    /**\n     * Scan the XML for use of <!ENTITY to prevent XXE/XEE attacks.\n     */","sourceCodeStart":76,"sourceCodeEnd":112,"githubUrl":"https://github.com/PHPOffice/PhpSpreadsheet/blob/65b080eef4d9fd11a5796135ab145883e5c3d6a6/src/PhpSpreadsheet/Reader/Security/XmlScanner.php#L76-L112","documentation":"Error \"Detected use of ENTITY in XML, spreadsheet file load() aborted to prevent XXE/XEE attacks\" thrown in PHPOffice/PhpSpreadsheet.","triggerScenarios":"Thrown at src/PhpSpreadsheet/Reader/Security/XmlScanner.php:94 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"65b080eef4d9fd11a5796135ab145883e5c3d6a6","analyzedAt":"2026-08-17T05:40:41.646Z","schemaVersion":2},"datasetVersion":"2026-08-17T09:17:11.063Z"}