Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-108360: PhpSpreadsheet may let external images trigger internal requests

CVE-2026-108360 · published 13 days ago

Summary

The PhpSpreadsheet library can load images from URLs. If an allowed image URL redirects to an internal address, the server will make an unseen request to that internal location, potentially exposing internal services or cloud metadata. Update to the latest version of PhpSpreadsheet or disable external image loading to prevent this behavior.

What to do

Update phpoffice phpspreadsheet to version 5.10.0.
Update phpoffice phpspreadsheet to version 3.10.8.
Update phpoffice phpspreadsheet to version 2.4.8.
Update phpoffice phpspreadsheet to version 2.1.19.
Update phpoffice phpspreadsheet to version 1.30.7.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	phpoffice	phpspreadsheet	< 1.30.7
composer	phpoffice	phpspreadsheet	>= 4.0.0, <= 5.9.0 >= 3.3.0, <= 3.10.7 >= 2.2.0, <= 2.4.7 >= 2.0.0, <= 2.1.18 <= 1.30.6 Fix: upgrade to 5.10.0

Original advisory text

PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Worksheet\Drawing::setPath validates only the initial external-image URL with setIsWhitelisted when setAllowExternalImages is enabled. The HTTP stream context permits PHP to follow a redirect without applying the callback to the redirected URL, so a permitted image host can redirect the server to an internal address and cause a blind GET request. The response body is not returned to the attacker because the reader validates the downloaded content as an image and removes the temporary file, but internal GET-driven endpoints, network reachability, and cloud metadata endpoints may be reached. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.

References

https://github.com/PHPOffice/PhpSpreadsheet/commit/299993894dce37aa3b64aa23e9a3f... x_refsource_MISC
https://github.com/PHPOffice/PhpSpreadsheet/commit/94590951d76a250a5fc1ecf69a0b3... x_refsource_MISC
https://github.com/PHPOffice/PhpSpreadsheet/commit/980b5c294493856f1a25754f1e8a1... x_refsource_MISC
https://github.com/PHPOffice/PhpSpreadsheet/commit/9a0b48622ebfe93fa48cb9bc09ce5... x_refsource_MISC
https://github.com/PHPOffice/PhpSpreadsheet/commit/da13f40e8760d599b0e8a296017d4... x_refsource_MISC
https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-2phh-27fw-q... x_refsource_CONFIRM
https://nvd.nist.gov/vuln/detail/CVE-2026-108360
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-1083... Vendor Advisory
https://github.com/advisories/GHSA-2phh-27fw-q4gc
https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.7 x_refsource_MISC
https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.19 x_refsource_MISC
https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.8 x_refsource_MISC
https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.8 x_refsource_MISC
https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.10.0 x_refsource_MISC

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.4 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-863Incorrect Authorization

CWE-918Server-Side Request Forgery (SSRF)

Timeline

Published22 Oct 2026

Updated4 Nov 2026

First seen22 Oct 2026

Sources

CVE-2026-108360 · NVD

CVE-2026-108360 · MITRE

CVE-2026-108360 · OSV

GHSA-2phh-27fw-q4gc · GHSA

Track software like this

Free during beta