PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Worksheet\Drawing::setPath validates only the initial external-image URL with setIsWhitelisted when setAllowExternalImages is enabled. The HTTP stream context permits PHP to follow a redirect without applying the callback to the redirected URL, so a permitted image host can redirect the server to an internal address and cause a blind GET request. The response body is not returned to the attacker because the reader validates the downloaded content as an image and removes the temporary file, but internal GET-driven endpoints, network reachability, and cloud metadata endpoints may be reached. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.
CVE-2026-108360
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-108360
PhpSpreadsheet
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "PHPOffice",
"product": "PhpSpreadsheet",
"versions": [
{
"status": "affected",
"version": "< 1.30.7"
},
{
"status": "affected",
"version": ">= 2.0.0, < 2.1.19"
},
{
"status": "affected",
"version": ">= 2.2.0, < 2.4.8"
},
{
"status": "affected",
"version": ">= 3.3.0, < 3.10.8"
},
{
"status": "affected",
"version": ">= 4.0.0, < 5.10.0"
}
]
}
]- Related CVEs
- CVE-2026-108360
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #50454 · Revision 1
- Added to Heist Feed
- Publisher date