composer›phpoffice/common›CVE-2018-140659.8 CRITICALImproper Restriction of XML External Entity ReferenceXMLReader.php in PHPOffice Common allows XXE.