Read the docs
TI-2026-42739 Aliases CVE-2026-59931GHSA-6hq5-7373-42rg

PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist

Priority HIGH 67CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.

Summary

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE() domain whitelist can be bypassed via an HTTP redirect (SSRF). In Calculation/Web/Service.php, the webService() method validates a URL's host against the whitelist set via Spreadsheet::setDomainWhiteList(), then fetches content with file_get_contents($url, false, $ctx); because PHP's HTTP stream wrapper follows 301/302 redirects automatically (up to 20 hops) and the redirect target is never re-validated, an attacker who can trigger a redirect from a whitelisted domain can reach arbitrary URLs, including internal addresses. An attacker able to upload XLSX files to an application that uses setDomainWhiteList() and getCalculatedValue() can achieve a full-read SSRF, returning up to 32,767 bytes of the response body as a cell's calculated value, which enables exfiltration of cloud metadata (AWS/GCP/Azure credentials via http://169.254.169.254/), access to internal-only services, and internal port scanning (the port is not validated). This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00474 41st percentileScored 2026-11-07
Fix Fixed PhpSpreadsheet (PHPOffice): 5.8.1, 3.10.7, 2.4.7 +2phpoffice/phpspreadsheet (Packagist): 5.8.1, 3.10.7, 2.4.7 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PHPOfficePhpSpreadsheet4.0.0 to before 5.8.1; 3.3.0 to before 3.10.7; 2.2.0 to before 2.4.7; 2.0.0 to before 2.1.18; before 1.30.65.8.1, 3.10.7, 2.4.7, 2.1.18, 1.30.6Patch availableCNA
—phpoffice/phpspreadsheet (Packagist)4.0.0 to before 5.8.15.8.1Patch availableGHSA-6hq5-7373-42rg
—phpoffice/phpspreadsheet (Packagist)3.3.0 to before 3.10.73.10.7Patch availableGHSA-6hq5-7373-42rg
—phpoffice/phpspreadsheet (Packagist)2.2.0 to before 2.4.72.4.7Patch availableGHSA-6hq5-7373-42rg
—phpoffice/phpspreadsheet (Packagist)2.0.0 to before 2.1.182.1.18Patch availableGHSA-6hq5-7373-42rg
—phpoffice/phpspreadsheet (Packagist)before 1.30.61.30.6Patch availableGHSA-6hq5-7373-42rg
  • PhpSpreadsheet VendorPHPOffice Affected 4.0.0 to before 5.8.1; 3.3.0 to before 3.10.7; 2.2.0 to before 2.4.7; 2.0.0 to before 2.1.18; before 1.30.6 Fixed in 5.8.1, 3.10.7, 2.4.7, 2.1.18, 1.30.6 Patch available CNA
  • phpoffice/phpspreadsheet (Packagist) Vendor— Affected 4.0.0 to before 5.8.1 Fixed in 5.8.1 Patch available GHSA-6hq5-7373-42rg
  • phpoffice/phpspreadsheet (Packagist) Vendor— Affected 3.3.0 to before 3.10.7 Fixed in 3.10.7 Patch available GHSA-6hq5-7373-42rg
  • phpoffice/phpspreadsheet (Packagist) Vendor— Affected 2.2.0 to before 2.4.7 Fixed in 2.4.7 Patch available GHSA-6hq5-7373-42rg
  • phpoffice/phpspreadsheet (Packagist) Vendor— Affected 2.0.0 to before 2.1.18 Fixed in 2.1.18 Patch available GHSA-6hq5-7373-42rg
  • phpoffice/phpspreadsheet (Packagist) Vendor— Affected before 1.30.6 Fixed in 1.30.6 Patch available GHSA-6hq5-7373-42rg

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*——PHPOffice
  • cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:* Versions — — ·PHPOffice

Remediation

  • Fix · CNA PhpSpreadsheet (PHPOffice) Fixed in 5.8.1, 3.10.7, 2.4.7, 2.1.18, 1.30.6
  • Fix · GHSA-6hq5-7373-42rg phpoffice/phpspreadsheet (Packagist) Fixed in 5.8.1 Advisory →
  • Fix · GHSA-6hq5-7373-42rg phpoffice/phpspreadsheet (Packagist) Fixed in 3.10.7 Advisory →
  • Fix · GHSA-6hq5-7373-42rg phpoffice/phpspreadsheet (Packagist) Fixed in 2.4.7 Advisory →
  • Fix · GHSA-6hq5-7373-42rg phpoffice/phpspreadsheet (Packagist) Fixed in 2.1.18 Advisory →
  • Fix · GHSA-6hq5-7373-42rg phpoffice/phpspreadsheet (Packagist) Fixed in 1.30.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-59931
  2. 2026-10-03 Alias added: GHSA-6hq5-7373-42rg

References

Other 8

  • TI-2026-32885 PhpSpreadsheet: File::prohibitWrappers bypass CVSS 4.0CRITICAL 9.2
  • TI-2026-26406 PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load CVSS 4.0CRITICAL 9.2
  • TI-2026-79412 PhpSpreadsheet ODS reader exhausts CPU and memory via repeated rows CVSS 4.0HIGH 8.7
  • TI-2025-34182 PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser CVSS 4.0HIGH 8.7
  • TI-2026-78784 Insecure deserialization in PHPOffice PHPPresentation allows code execution CVSS 4.0CRITICAL 9.2
  • TI-2024-37339 PhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php file CVSS 4.0HIGH 8.3
See all 37 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences