Log in Start free

Vulnerability · Published Jul 28, 2026 · Assigned by GitHub_M

CVE-2026-59931PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist

High 7.7

In plain English

A high-severity server-side request forgery in PhpSpreadsheet from PHPOffice. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.7High
Exploit odds (30 days)0.5%top 58.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE() domain whitelist can be bypassed via an HTTP redirect (SSRF). In Calculation/Web/Service.php, the webService() method validates a URL's host against the whitelist set via Spreadsheet::setDomainWhiteList(), then fetches content with file_get_contents($url, false, $ctx); because PHP's HTTP stream wrapper follows 301/302 redirects automatically (up to 20 hops) and the redirect target is never re-validated, an attacker who can trigger a redirect from a whitelisted domain can reach arbitrary URLs, including internal addresses. An attacker able to upload XLSX files to an application that uses setDomainWhiteList() and getCalculatedValue() can achieve a full-read SSRF, returning up to 32,767 bytes of the response body as a cell's calculated value, which enables exfiltration of cloud metadata (AWS/GCP/Azure credentials via http://169.254.169.254/), access to internal-only services, and internal port scanning (the port is not validated). This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistphpoffice/phpspreadsheet5.8.1GHSA-6hq5-7373-42rg
Packagistphpoffice/phpspreadsheet3.10.7GHSA-6hq5-7373-42rg
Packagistphpoffice/phpspreadsheet2.4.7GHSA-6hq5-7373-42rg
Packagistphpoffice/phpspreadsheet2.1.18GHSA-6hq5-7373-42rg
Packagistphpoffice/phpspreadsheet1.30.6GHSA-6hq5-7373-42rg

Affected products (as reported)

VendorProductVersions
PHPOffice PhpSpreadsheet >= 4.0.0, < 5.8.1>= 3.3.0, < 3.10.7>= 2.2.0, < 2.4.7>= 2.0.0, < 2.1.18< 1.30.6

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References