{"id":"CVE-2026-108360","summary":"PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading","details":"PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Worksheet\\Drawing::setPath validates only the initial external-image URL with setIsWhitelisted when setAllowExternalImages is enabled. The HTTP stream context permits PHP to follow a redirect without applying the callback to the redirected URL, so a permitted image host can redirect the server to an internal address and cause a blind GET request. The response body is not returned to the attacker because the reader validates the downloaded content as an image and removes the temporary file, but internal GET-driven endpoints, network reachability, and cloud metadata endpoints may be reached. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.","aliases":["GHSA-2phh-27fw-q4gc"],"modified":"2026-10-23T02:45:13.327424898Z","published":"2026-10-22T17:26:59.148Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-863","CWE-918"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108360.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108360.json"},{"type":"FIX","url":"https://github.com/PHPOffice/PhpSpreadsheet/commit/299993894dce37aa3b64aa23e9a3f4bb77ab0e66"},{"type":"FIX","url":"https://github.com/PHPOffice/PhpSpreadsheet/commit/94590951d76a250a5fc1ecf69a0b3f7439a9af49"},{"type":"FIX","url":"https://github.com/PHPOffice/PhpSpreadsheet/commit/980b5c294493856f1a25754f1e8a1d2185b93738"},{"type":"FIX","url":"https://github.com/PHPOffice/PhpSpreadsheet/commit/9a0b48622ebfe93fa48cb9bc09ce57303bb07af9"},{"type":"FIX","url":"https://github.com/PHPOffice/PhpSpreadsheet/commit/da13f40e8760d599b0e8a296017d4b028b20e86c"},{"type":"WEB","url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.7"},{"type":"WEB","url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.19"},{"type":"WEB","url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.8"},{"type":"WEB","url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.8"},{"type":"WEB","url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.10.0"},{"type":"ADVISORY","url":"https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-2phh-27fw-q4gc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108360"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/phpoffice/phpspreadsheet","events":[{"introduced":"0"},{"fixed":"f5dd9c1f084d336ea63cf53099533e061a9c157a"},{"introduced":"4a77798f835119754961a97714f135826a323caa"},{"fixed":"eb2ad61ccffa21bdc77481c69403f2bed5b13e5b"},{"introduced":"b0993b7e4d9c860133365d115b176bc6e0f57022"},{"fixed":"badf4f22c54332046af37687c3384c6a0ed14ae1"},{"introduced":"87ddd21eb0b6b7ad20a11d314348ef307475f547"},{"fixed":"fee9c1ca8d9f1f676f007ac1ab134ce43624bd52"},{"introduced":"2d4b9f3582102aafb6b1378fff8a20eeeacfb31c"},{"fixed":"eb18727acf6b1f4cc67145a52ab04f9fd4c28d53"},{"fixed":"299993894dce37aa3b64aa23e9a3f4bb77ab0e66"},{"fixed":"94590951d76a250a5fc1ecf69a0b3f7439a9af49"},{"fixed":"980b5c294493856f1a25754f1e8a1d2185b93738"},{"fixed":"9a0b48622ebfe93fa48cb9bc09ce57303bb07af9"},{"fixed":"da13f40e8760d599b0e8a296017d4b028b20e86c"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"0"},{"fixed":"1.30.7"}]},{"strategy":"StringRangeExpression","range":[{"introduced":"2.0.0"},{"fixed":"2.1.19"}],"source":"AFFECTED_FIELD"},{"strategy":"StringRangeExpression","range":[{"introduced":"2.2.0"},{"fixed":"2.4.8"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"3.3.0"},{"fixed":"3.10.8"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"range":[{"introduced":"4.0.0"},{"fixed":"5.10.0"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"299993894dce37aa3b64aa23e9a3f4bb77ab0e66"}]},{"range":[{"fixed":"94590951d76a250a5fc1ecf69a0b3f7439a9af49"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"980b5c294493856f1a25754f1e8a1d2185b93738"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"9a0b48622ebfe93fa48cb9bc09ce57303bb07af9"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"da13f40e8760d599b0e8a296017d4b028b20e86c"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_TAG","original_tag":"1.30.7","range":[{"fixed":"f5dd9c1f084d336ea63cf53099533e061a9c157a"}]},{"original_tag":"2.1.19","range":[{"fixed":"eb2ad61ccffa21bdc77481c69403f2bed5b13e5b"}],"source":"REFERENCES_TAG"},{"original_tag":"2.4.8","range":[{"fixed":"badf4f22c54332046af37687c3384c6a0ed14ae1"}],"source":"REFERENCES_TAG"},{"original_tag":"3.10.8","range":[{"fixed":"fee9c1ca8d9f1f676f007ac1ab134ce43624bd52"}],"source":"REFERENCES_TAG"},{"range":[{"fixed":"eb18727acf6b1f4cc67145a52ab04f9fd4c28d53"}],"source":"REFERENCES_TAG","original_tag":"5.10.0"}]}}],"versions":["5.9.0","1.30.6","3.10.7","2.4.7","2.1.18","3.10.6","2.4.6","2.1.17","1.30.5","5.8.0","3.10.5","2.4.5","2.1.16","1.30.4","5.7.0","5.6.0","1.30.3","3.10.4","2.4.4","2.1.15","5.5.0","3.10.3","1.30.2","2.4.3","2.1.14","5.4.0","5.3.0","3.10.2","2.1.13","1.30.1","2.4.2","5.1.0","5.2.0","3.10.1","2.4.1","3.10.0","2.4.0","2.1.12","1.30.0","5.0.0","1.29.12","3.9.3","2.3.10","2.1.11","4.5.0","3.9.2","2.3.9","2.1.10","1.29.11","4.4.0","4.3.0","4.3.1","4.2.0","4.1.0","3.3.0","3.9.0","1.29.10","3.9.1","2.3.8","2.1.9","4.0.0","2.3.7","2.1.8","1.29.9","3.8.0","2.3.6","2.1.7","1.29.8","2.3.5","2.1.6","1.29.7","3.7.0","1.29.6","2.3.4","2.1.5","3.6.0","2.3.3","2.1.4","1.29.5","3.5.0","3.4.0","2.3.2","2.1.3","1.29.4","1.29.2","2.1.1","2.3.0","2.1.0","1.29.1","2.2.2","1.29.0","2.2.1","2.2.0","2.0.0","1.28.0","1.27.0","1.25.2","1.25.1","1.25.0","1.24.1","1.24.0","1.23.0","1.22.0","1.21.0","1.20.0","1.19.0","1.18.0","1.17.1","1.17.0","1.16.0","1.15.0","1.14.1","1.14.0","1.13.0","1.12.0","1.11.0","1.10.1","1.10.0","1.8.2","1.8.1","1.8.0","1.7.0","1.6.0","1.5.0","1.4.1","1.4.0","1.3.1","1.3.0","1.2.1","1.2.0","1.1.0","1.0.0","1.0.0-beta2","phpexcel-last-cherry-picked-commit","phpexcel-last-release-1.8.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108360.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}]}