Live › vulnerability › CVE-2026-108360
Go to dashboardPhpSpreadsheet only checks the first URL of an external image when external images are allowed, and PHP follows redirects without rechecking them. An attacker who controls an allowed image host can make the server send a blind GET request to internal addresses, including cloud metadata endpoints, though the response body is not returned.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that read or write spreadsheets with PhpSpreadsheet and have external image loading enabled via setAllowExternalImages are exposed, especially when they process user-uploaded spreadsheets. Applications that keep external images disabled, which is the default, can skip it.
No product ranges from the sources yet.
composer show phpoffice/phpspreadsheet and compare the version to the fixed releases.setAllowExternalImages(true) is called anywhere in the application code.setIsWhitelisted is set on the drawing or reader.1.30.7, 2.1.19, 2.4.8, 3.10.8, or 5.10.0 depending on the major line in use.setAllowExternalImages(false) if upgrading is not possible.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Worksheet\Drawing::setPath validates only the initial external-image URL with setIsWhitelisted when setAllowExternalImages is enabled. The HTTP stream context permits PHP to follow a redirect without applying the callback to the redirected URL, so a permitted image host can redirect the server to an internal address and cause a blind GET request. The response body is not returned to the attacker because the reader validates the downloaded content as an image and removes the temporary file, but internal GET-driven endpoints, network reachability, and cloud metadata endpoints may be reached. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-108360")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.