Read the docs
TI-2026-79333 Aliases CVE-2026-108360GHSA-2phh-27fw-q4gc

PhpSpreadsheet SSRF allowlist bypass via unchecked HTTP redirect

Priority MEDIUM 62CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

PhpSpreadsheet versions before 1.30.7, from 2.0.0 before 2.1.19, from 2.2.0 before 2.4.8, from 3.3.0 before 3.10.8, and from 4.0.0 before 5.10.0 are affected. Drawing::setPath checks only the first external image URL against the allowlist, and the HTTP stream follows redirects without checking the target (CWE-918). An attacker who controls an allowed image host can redirect the server to an internal address and cause a blind GET request, though the response body is not returned.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Worksheet\Drawing::setPath validates only the initial external-image URL with setIsWhitelisted when setAllowExternalImages is enabled. The HTTP stream context permits PHP to follow a redirect without applying the callback to the redirected URL, so a permitted image host can redirect the server to an internal address and cause a blind GET request. The response body is not returned to the attacker because the reader validates the downloaded content as an image and removes the temporary file, but internal GET-driven endpoints, network reachability, and cloud metadata endpoints may be reached. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00339 27th percentileScored 2026-11-07
Fix Fixed PhpSpreadsheet (PHPOffice): 1.30.7, 2.1.19, 2.4.8 +2phpoffice/phpspreadsheet (Packagist): 5.10.0, 3.10.8, 2.4.8 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PHPOfficePhpSpreadsheetbefore 1.30.7; 2.0.0 to before 2.1.19; 2.2.0 to before 2.4.8; 3.3.0 to before 3.10.8; 4.0.0 to before 5.10.01.30.7, 2.1.19, 2.4.8, 3.10.8, 5.10.0Patch availableCNA
—phpoffice/phpspreadsheet (Packagist)4.0.0 to before 5.10.05.10.0Patch availableGHSA-2phh-27fw-q4gc
—phpoffice/phpspreadsheet (Packagist)3.3.0 to before 3.10.83.10.8Patch availableGHSA-2phh-27fw-q4gc
—phpoffice/phpspreadsheet (Packagist)2.2.0 to before 2.4.82.4.8Patch availableGHSA-2phh-27fw-q4gc
—phpoffice/phpspreadsheet (Packagist)2.0.0 to before 2.1.192.1.19Patch availableGHSA-2phh-27fw-q4gc
—phpoffice/phpspreadsheet (Packagist)before 1.30.71.30.7Patch availableGHSA-2phh-27fw-q4gc
  • PhpSpreadsheet VendorPHPOffice Affected before 1.30.7; 2.0.0 to before 2.1.19; 2.2.0 to before 2.4.8; 3.3.0 to before 3.10.8; 4.0.0 to before 5.10.0 Fixed in 1.30.7, 2.1.19, 2.4.8, 3.10.8, 5.10.0 Patch available CNA
  • phpoffice/phpspreadsheet (Packagist) Vendor— Affected 4.0.0 to before 5.10.0 Fixed in 5.10.0 Patch available GHSA-2phh-27fw-q4gc
  • phpoffice/phpspreadsheet (Packagist) Vendor— Affected 3.3.0 to before 3.10.8 Fixed in 3.10.8 Patch available GHSA-2phh-27fw-q4gc
  • phpoffice/phpspreadsheet (Packagist) Vendor— Affected 2.2.0 to before 2.4.8 Fixed in 2.4.8 Patch available GHSA-2phh-27fw-q4gc
  • phpoffice/phpspreadsheet (Packagist) Vendor— Affected 2.0.0 to before 2.1.19 Fixed in 2.1.19 Patch available GHSA-2phh-27fw-q4gc
  • phpoffice/phpspreadsheet (Packagist) Vendor— Affected before 1.30.7 Fixed in 1.30.7 Patch available GHSA-2phh-27fw-q4gc

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*——PHPOffice
  • cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:* Versions — — ·PHPOffice

Remediation

Fixed versions for the phpoffice/phpspreadsheet package on Packagist are 1.30.7, 2.1.19, 2.4.8, 3.10.8 and 5.10.0, one for each release branch.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA PhpSpreadsheet (PHPOffice) Fixed in 1.30.7, 2.1.19, 2.4.8, 3.10.8, 5.10.0
  • Fix · GHSA-2phh-27fw-q4gc phpoffice/phpspreadsheet (Packagist) Fixed in 5.10.0 Advisory →
  • Fix · GHSA-2phh-27fw-q4gc phpoffice/phpspreadsheet (Packagist) Fixed in 3.10.8 Advisory →
  • Fix · GHSA-2phh-27fw-q4gc phpoffice/phpspreadsheet (Packagist) Fixed in 2.4.8 Advisory →
  • Fix · GHSA-2phh-27fw-q4gc phpoffice/phpspreadsheet (Packagist) Fixed in 2.1.19 Advisory →
  • Fix · GHSA-2phh-27fw-q4gc phpoffice/phpspreadsheet (Packagist) Fixed in 1.30.7 Advisory →

Timeline

  1. 2026-10-22 Threatist record created from CVE-2026-108360
  2. 2026-10-23 Priority changed: MEDIUM → LOW
  3. 2026-10-27 Alias added: GHSA-2phh-27fw-q4gc
  4. 2026-10-29 CISA SSVC decision points changed
  5. 2026-10-29 Priority changed: LOW → MEDIUM

References

Advisory 1

Other 12

  • TI-2026-32885 PhpSpreadsheet: File::prohibitWrappers bypass CVSS 4.0CRITICAL 9.2
  • TI-2026-26406 PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load CVSS 4.0CRITICAL 9.2
  • TI-2026-79412 PhpSpreadsheet ODS reader exhausts CPU and memory via repeated rows CVSS 4.0HIGH 8.7
  • TI-2025-34182 PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser CVSS 4.0HIGH 8.7
  • TI-2026-78784 Insecure deserialization in PHPOffice PHPPresentation allows code execution CVSS 4.0CRITICAL 9.2
  • TI-2024-37339 PhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php file CVSS 4.0HIGH 8.3
See all 37 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences