---
id: "CVE-2026-108360"
kind: "vulnerability"
aliases: ["CVE-2026-108360"]
title: "PhpSpreadsheet: image redirects let a server send blind internal requests"
severity: "medium"
cvss: 6.4
epss: 0.00221
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cloud", "package", "php", "phpspreadsheet", "self-hosted"]
not_affected_if: ["default-config", "external-images-disabled"]
published_at: "2026-10-22T18:17:26+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-25T03:59:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108360", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-108360", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# PhpSpreadsheet: image redirects let a server send blind internal requests

PhpSpreadsheet only checks the first URL of an external image when external images are allowed, and PHP follows redirects without rechecking them. An attacker who controls an allowed image host can make the server send a blind GET request to internal addresses, including cloud metadata endpoints, though the response body is not returned.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `composer show phpoffice/phpspreadsheet` and compare the version to the fixed releases.
- Check whether `setAllowExternalImages(true)` is called anywhere in the application code.
- Check whether `setIsWhitelisted` is set on the drawing or reader.

## Fix

- Upgrade phpoffice/phpspreadsheet to `1.30.7`, `2.1.19`, `2.4.8`, `3.10.8`, or `5.10.0` depending on the major line in use.
- Disable external images with `setAllowExternalImages(false)` if upgrading is not possible.

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-108360
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-108360

## From the sources

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Worksheet\Drawing::setPath validates only the initial external-image URL with setIsWhitelisted when setAllowExternalImages is enabled. The HTTP stream context permits PHP to follow a redirect without applying the callback to the redirected URL, so a permitted image host can redirect the server to an internal address and cause a blind GET request. The response body is not returned to the attacker because the reader validates the downloaded content as an image and removes the temporary file, but internal GET-driven endpoints, network reachability, and cloud metadata endpoints may be reached. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_