ZDF
Sign inSign up

Vulnerabilities

Security incident · CVE-2026-108360

PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading

Published Oct 22, 2026 · catalog updated Oct 27, 2026 · PHPOffice PhpSpreadsheet

Last checked Nov 5, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-108360. EPSS is 0.34%. Act only if a listed version of PHPOffice PhpSpreadsheet is installed.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.

Same product and reporting

Severity
Medium6.4
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.34%
Remediation
Version ranges on file
Affected products
composer phpoffice · composer phpoffice/phpspreadsheet · vendor PHPOffice PhpSpreadsheet

## Summary PhpSpreadsheet's validates an external-image URL against an operator-supplied callback **once**, on the initial URL only, then fetches it with using a stream context that does **not** set . A whitelisted host that returns an HTTP redirect to an internal target is therefore followed by PHP's HTTP wrapper (default , ) with **no re-validation of the redirect hop** — defeating the whitelist and yielding a blind SSRF from the server. This is an unfixed variant of CVE-2026-59931 (GHSA-6hq5-7373-42rg, the WEBSERVICE redirect-whitelist-bypass): the fix (commit ) was applied ONLY to ; was never touched. ## Root Cause : - Scheme allowlist at ( ) permits / (the redirect-following schemes) and runs on the initial URL only. - Opt-in gate at (requires ; default , ). - Whitelist check at — validates the INITIAL URL only; never re-applied after a redirect. - Stream context built at sets + (+ for https) but **omits **. on tag 5.9.0 yields a single hit — (the CVE-2026-59931 fix) — confirming it was never added to . - Sink at . ## Impact Blind SSRF from the server: reach and trigger internal GET-driven endpoints, coarse internal reachability/port probing, and reach cloud-metadata endpoints. The fetched body is written to a temp file, checked with (mime , or with / extension), only image dimensions are stored, and the temp file is ed — so the response body is **not** exfiltrated (non-image responses fail ). This is a blind GET primitive, not full response read. ## Proof of Concept 1. Attacker server returns . 2. with : . 3. Victim: -> the server-side GET is forced to the internal target despite the whitelist. HTML-reader variant: loaded via ( ) with the same reader settings. ## Attack Chain 1. Entry: crafted , , (whitelisted host). Guard: none (legal external-image relationship). Bypass proof: Target stored verbatim -> at . 2. Config: victim loads with where allows . Guard: opt-in (satisfied) + whitelist. Bypass proof: initial URL is whitelisted -> returns true; check runs o

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • composer phpofficeversion unspecified
  • composer phpoffice/phpspreadsheet<= 1.30.6
  • composer phpoffice/phpspreadsheet>= 2.0.0, <= 2.1.18
  • composer phpoffice/phpspreadsheet>= 2.2.0, <= 2.4.7
  • composer phpoffice/phpspreadsheet>= 3.3.0, <= 3.10.7
  • composer phpoffice/phpspreadsheet>= 4.0.0, <= 5.9.0
  • vendor PHPOffice PhpSpreadsheetversion unspecified

How to fix CVE-2026-108360

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-108360. EPSS is 0.34%. Act only if a listed version of PHPOffice PhpSpreadsheet is installed.

Which versions are affected?

Compare what you have installed with <= 1.30.6, >= 2.0.0, <= 2.1.18, >= 2.2.0, <= 2.4.7, >= 3.3.0, <= 3.10.7, >= 4.0.0, <= 5.9.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-863: Incorrect Authorization; CWE-918: Server-Side Request Forgery (SSRF). EPSS 0.34%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 27, 2026 · GitHub Advisory Database

    Detected

    ## Summary PhpSpreadsheet's validates an external-image URL against an operator-supplied callback **once**, on the initial URL only, then fetches it with using a stream context that does **not** set . A whitelisted host that returns an HTTP redirect to an internal target is therefore followed by PHP's HTTP wrapper (default , ) with **no re-validation of the redirect hop** — defeating the whitelist

  2. Oct 27, 2026 · GitHub Advisory Database

    Updated

    ## Summary PhpSpreadsheet's validates an external-image URL against an operator-supplied callback **once**, on the initial URL only, then fetches it with using a stream context that does **not** set . A whitelisted host that returns an HTTP redirect to an internal target is therefore followed by PHP's HTTP wrapper (default , ) with **no re-validation of the redirect hop** — defeating the whitelist

Sources

  • CVE.orgVulnerability recordCVE-2026-108360

    PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Worksheet\Drawing::setPath validates only the initial external-image URL with setIsWhitelisted when setAllowExternalImages is enabled. The HTTP stre

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-108360

    30-day exploitation probability 0.34%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-2phh-27fw-q4gc

    PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-108360

    PhpSpreadsheet's Worksheet\Drawing::setPath() validates an external-image URL against an operator-supplied isWhitelisted callback once, on the initial URL only, then fetches it with file_get_contents() using a stream context that does not set follow_location => 0. A whitelisted host that returns an HTTP 302 Location: redirect to an internal target is therefore followed by PHP's HTTP wrapper (defau

    advisories.gitlab.com

References

Freshness

Last verified in this catalog Nov 5, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • FIRST EPSSNov 5, 2026
  • GitLab Advisory DatabaseOct 28, 2026
  • GitHub Advisory DatabaseOct 28, 2026
  • CVE.orgOct 27, 2026