{"id":"CVE-2026-108360","revision":"7611c0ca9d2e4751870b81f699614dec","records":[{"revision":"7611c0ca9d2e4751870b81f699614dec","observedAt":"2026-10-29T13:12:12.589+00:00","statement":{"source":"cve-program","id":"CVE-2026-108360","aliases":[],"title":"PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading","description":"PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Worksheet\\Drawing::setPath validates only the initial external-image URL with setIsWhitelisted when setAllowExternalImages is enabled. The HTTP stream context permits PHP to follow a redirect without applying the callback to the redirected URL, so a permitted image host can redirect the server to an internal address and cause a blind GET request. The response body is not returned to the attacker because the reader validates the downloaded content as an image and removes the temporary file, but internal GET-driven endpoints, network reachability, and cloud metadata endpoints may be reached. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.","state":0,"publishedAt":"2026-10-22T17:26:59.148+00:00","modifiedAt":"2026-10-29T11:50:16.342+00:00","affected":[{"ecosystem":"Vendor product","name":"PhpSpreadsheet","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"PHPOffice\",\n                    \"product\": \"PhpSpreadsheet\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.30.7\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 2.0.0, < 2.1.19\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 2.2.0, < 2.4.8\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 3.3.0, < 3.10.8\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 4.0.0, < 5.10.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","score":6.4,"severity":"MEDIUM"}],"references":["https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-2phh-27fw-q4gc","https://github.com/PHPOffice/PhpSpreadsheet/commit/299993894dce37aa3b64aa23e9a3f4bb77ab0e66","https://github.com/PHPOffice/PhpSpreadsheet/commit/94590951d76a250a5fc1ecf69a0b3f7439a9af49","https://github.com/PHPOffice/PhpSpreadsheet/commit/980b5c294493856f1a25754f1e8a1d2185b93738","https://github.com/PHPOffice/PhpSpreadsheet/commit/9a0b48622ebfe93fa48cb9bc09ce57303bb07af9","https://github.com/PHPOffice/PhpSpreadsheet/commit/da13f40e8760d599b0e8a296017d4b028b20e86c","https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.7","https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.19","https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.8","https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.8","https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.10.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-108360","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-108360","identifiers":["CVE-2026-108360"]},"retained":false,"historicalAffected":[]}],"coverage":[]}