Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-108360— PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading

Quick assessment

Affected
PHPOffice PhpSpreadsheet
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

PhpSpreadsheet 是一个用于读写电子表格文件的纯 PHP 库。在 1.30.7、2.1.19、2.4.8、3.10.8 和 5.10.0 版本之前，当启用 时， 方法仅通过 对初始外部图片 URL 进行验证。由于 HTTP 流上下文允许 PHP 在重定向时绕过对目标 URL 的回调检查，因此一个被允许的图片主机可以将服务器重定向到内部地址，从而触发盲 GET 请求。虽然响应体不会返回给攻击者（因为读取器会验证下载内容是否为图片并删除临时文件），但攻击者仍可借此访问由 GET 请求驱动的内部端点、探测网络

CVSS 6.4 · Medium

Affected Version Matrix 5

VendorProduct Version RangeStatus
PHPOffice PhpSpreadsheet < 1.30.7 affected
>= 2.0.0, < 2.1.19 affected
>= 2.2.0, < 2.4.8 affected
>= 3.3.0, < 3.10.8 affected
>= 4.0.0, < 5.10.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-108360

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading
Source: CVE Program / CVE List V5
Vulnerability Description
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Worksheet\Drawing::setPath validates only the initial external-image URL with setIsWhitelisted when setAllowExternalImages is enabled. The HTTP stream context permits PHP to follow a redirect without applying the callback to the redirected URL, so a permitted image host can redirect the server to an internal address and cause a blind GET request. The response body is not returned to the attacker because the reader validates the downloaded content as an image and removes the temporary file, but internal GET-driven endpoints, network reachability, and cloud metadata endpoints may be reached. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
PHPOffice PhpSpreadsheet < 1.30.7 -

II. Public POCs for CVE-2026-108360

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-108360

请登录查看更多情报信息。

Other References for CVE-2026-108360 (11)

Same Patch Batch · PHPOffice · 2026-10-22 · 4 CVEs total

CVE-2026-108357 8.8 HIGH PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Deni
CVE-2026-108358 8.8 HIGH PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of S
CVE-2026-108359 8.7 HIGH PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)

IV. Related Vulnerabilities

Same product: PhpSpreadsheet
Same vendor: PHPOffice
Same weakness: CWE-863

V. Comments for CVE-2026-108360

No comments yet

Leave a comment