CVE-2026-108360: PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Worksheet\Drawing::setPath validates only the initial external-image URL with setIsWhitelisted when setAllowExternalImages is enabled. The HTTP stream context permits PHP to follow a redirect without applying the callback to the redirected URL, so a permitted image host can redirect the server to an internal address and cause a blind GET request. The response body is not returned to the attacker because the reader validates the downloaded content as an image and removes the temporary file, but internal GET-driven endpoints, network reachability, and cloud metadata endpoints may be reached. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PhpSpreadsheetto a version that resolves this vulnerability.Fixed in 1.30.7 - Upgrade
Upgrade
PhpSpreadsheetto a version that resolves this vulnerability.Fixed in 2.1.19 - Upgrade
Upgrade
PhpSpreadsheetto a version that resolves this vulnerability.Fixed in 2.4.8 - Upgrade
Upgrade
PhpSpreadsheetto a version that resolves this vulnerability.Fixed in 3.10.8 - Upgrade
Upgrade
PhpSpreadsheetto a version that resolves this vulnerability.Fixed in 5.10.0
Event History
Frequently Asked Questions
When is an application exposed to this issue?
It is exposed when it uses Worksheet\Drawing::setPath with external image loading enabled through setAllowExternalImages, and permits an initial image URL that an attacker can make redirect elsewhere. The affected behavior is present before versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.
What does an attacker need to exploit the bypass?
The attacker needs the ability to supply or influence an external image URL accepted by the whitelist. That permitted URL must redirect to an internal or otherwise restricted destination, because redirects are followed without re-validating the destination URL.
What can an attacker obtain or do through the SSRF?
The issue causes a blind GET request from the server to the redirected destination. The response body is not returned to the attacker, but internal GET-driven endpoints, network reachability, and cloud metadata endpoints may still be reached.
What can be done if upgrading is not immediately possible?
Do not enable external image loading where it is not required, and avoid accepting attacker-controlled external image URLs. Restrict permitted image hosts so they cannot redirect to internal addresses or other restricted destinations.