{"id":"CVE-2026-108360","aliases":["GHSA-2phh-27fw-q4gc"],"title":"PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading","summary":"PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading","severity":"medium","cvss":6.4,"cwe":["CWE-863","CWE-918"],"vendor":"phpoffice","product":"phpoffice/phpspreadsheet","ecosystem":"composer","affected":["phpoffice/phpspreadsheet >= 4.0.0, <= 5.9.0","phpoffice/phpspreadsheet >= 3.3.0, <= 3.10.7","phpoffice/phpspreadsheet >= 2.2.0, <= 2.4.7","phpoffice/phpspreadsheet >= 2.0.0, <= 2.1.18","phpoffice/phpspreadsheet <= 1.30.6"],"patched":["phpoffice/phpspreadsheet 5.10.0","phpoffice/phpspreadsheet 3.10.8","phpoffice/phpspreadsheet 2.4.8","phpoffice/phpspreadsheet 2.1.19","phpoffice/phpspreadsheet 1.30.7"],"published":"2026-10-27","updated":"2026-10-27","sourceUpdated":"2026-10-27T15:38:41Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-2phh-27fw-q4gc","references":[{"url":"https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-2phh-27fw-q4gc"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108360"},{"url":"https://github.com/PHPOffice/PhpSpreadsheet/commit/299993894dce37aa3b64aa23e9a3f4bb77ab0e66"},{"url":"https://github.com/PHPOffice/PhpSpreadsheet/commit/94590951d76a250a5fc1ecf69a0b3f7439a9af49"},{"url":"https://github.com/PHPOffice/PhpSpreadsheet/commit/980b5c294493856f1a25754f1e8a1d2185b93738"},{"url":"https://github.com/PHPOffice/PhpSpreadsheet/commit/9a0b48622ebfe93fa48cb9bc09ce57303bb07af9"},{"url":"https://github.com/PHPOffice/PhpSpreadsheet/commit/da13f40e8760d599b0e8a296017d4b028b20e86c"},{"url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.7"},{"url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.19"},{"url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.8"},{"url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.8"},{"url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.10.0"},{"url":"https://github.com/advisories/GHSA-2phh-27fw-q4gc"}],"tags":["ghsa","composer","cve.org"],"epss":0.00221,"epssPercentile":0.126,"ingestedAt":"2026-10-22T22:00:50.353Z","slug":"CVE-2026-108360","body":"## Overview\n\n## Summary\nPhpSpreadsheet's `Worksheet\\Drawing::setPath()` validates an external-image URL against an operator-supplied `isWhitelisted` callback **once**, on the initial URL only, then fetches it with `file_get_contents()` using a stream context that does **not** set `follow_location => 0`. A whitelisted host that returns an HTTP `302 Location:` redirect to an internal target is therefore followed by PHP's HTTP wrapper (default `follow_location=1`, `max_redirects=20`) with **no re-validation of the redirect hop** — defeating the whitelist and yielding a blind SSRF from the server.\n\nThis is an unfixed variant of CVE-2026-59931 (GHSA-6hq5-7373-42rg, the WEBSERVICE redirect-whitelist-bypass): the `follow_location => 0` fix (commit `7ef7b25e`) was applied ONLY to `Calculation/Web/Service.php`; `Worksheet/Drawing.php` was never touched.\n\n## Root Cause\n`src/PhpSpreadsheet/Worksheet/Drawing.php`:\n- Scheme allowlist at `:125` (`/^(http|https|file|ftp|s3):/`) permits `http`/`https` (the redirect-following schemes) and runs on the initial URL only.\n- Opt-in gate `if (!$allowExternal)` at `:128` (requires `setAllowExternalImages(true)`; default `false`, `BaseReader.php:55`).\n- Whitelist check `if ($isWhitelisted !== null && !$isWhitelisted($path))` at `:131` — validates the INITIAL URL only; never re-applied after a redirect.\n- Stream context built at `:140-152` sets `user_agent` + `header` (+ `ssl.crypto_method` for https) but **omits `follow_location`**. `git grep follow_location` on tag 5.9.0 yields a single hit — `Service.php:45` (the CVE-2026-59931 fix) — confirming it was never added to `Drawing.php`.\n- Sink `file_get_contents($path, false, $ctx)` at `:154`.\n\n## Impact\nBlind SSRF from the server: reach and trigger internal GET-driven endpoints, coarse internal reachability/port probing, and reach cloud-metadata endpoints. The fetched body is written to a temp file, checked with `isImage()` (mime `image/*`, or `application/octet-stream` with `bin`/`emf` extension), only image dimensions are stored, and the temp file is `unlink`ed — so the response body is **not** exfiltrated (non-image responses fail `isImage()`). This is a blind GET primitive, not full response read.\n\n## Proof of Concept\n1. Attacker server `https://trusted-whitelisted.example/redir.png` returns `302 Location: http://169.254.169.254/latest/meta-data/`.\n2. `evil.xlsx` with `xl/drawings/_rels/drawing1.xml.rels`: `<Relationship ... Type=\".../image\" Target=\"https://trusted-whitelisted.example/redir.png\" TargetMode=\"External\"/>`.\n3. Victim: `$r = new Xlsx(); $r->setAllowExternalImages(true)->setIsWhitelisted(fn($p)=>str_contains($p,'trusted-whitelisted.example')); $r->load('evil.xlsx');` -> the server-side GET is forced to the internal target despite the whitelist.\nHTML-reader variant: `<img src=\"https://trusted-whitelisted.example/redir.png\">` loaded via `Reader\\Html` (`Html.php:1237`) with the same reader settings.\n\n## Attack Chain\n1. Entry: crafted `evil.xlsx`, `xl/drawings/_rels/*.rels` `TargetMode=\"External\"`, `Target=\"https://trusted.example/redir.png\"` (whitelisted host). Guard: none (legal external-image relationship). Bypass proof: Target stored verbatim -> `$url` at `Reader/Xlsx.php:1544`.\n2. Config: victim loads with `setAllowExternalImages(true)->setIsWhitelisted($cb)` where `$cb` allows `trusted.example`. Guard: `Drawing.php:128` opt-in (satisfied) + `:131` whitelist. Bypass proof: initial URL is whitelisted -> returns true; check runs once on `$path`.\n3. Fetch/redirect: `file_get_contents` (`:154`) GETs the URL; whitelisted host returns `302 Location: http://169.254.169.254/...`. Guard: stream context (`:140-152`). Bypass proof: no `follow_location` key -> PHP follows the redirect (default `follow_location=1`, `max_redirects=20`) with no re-validation.\n4. Impact: server issues a blind GET to the internal target (body temp-filed, `isImage()`-checked, dimensions stored, temp file unlinked — body not exfiltrated).\n\n## Bypass Evidence\n- `git grep follow_location 5.9.0 -- src/` -> single hit at `Service.php:45`; `Drawing.php` has none.\n- CVE-2026-59931's own regression harness (`ServerTest.php` + `redirect.php`: a whitelisted host 302-redirects to `direct.php`; only after `follow_location => 0` does the fetch stop following it) demonstrates the exact behavior. That fix is present in `Service.php` and absent in `Drawing.php`.\n- `git grep isWhitelisted 5.9.0 -- src/` confirms the callback is applied only at `Drawing.php:131` (initial `$path`), never after the redirect.\n\n## Affected Versions\n`>= 5.5.0, <= 5.9.0`. The `isWhitelisted` control being bypassed was introduced in 5.5.0 (commit `50a7552f`); present and unfixed on the latest release (5.9.0) and on HEAD (`05e99ebf`). No post-release fix to `Drawing.php`.\n\n## Suggested Fix\nAdd `'follow_location' => 0` (and/or `'max_redirects' => 0`) to `$ctxArray['http']` in `Drawing::setPath()` (`:140-148`), mirroring the CVE-2026-59931 fix at `Service.php:45`; alternatively follow redirects manually and re-run `$isWhitelisted` on each hop.\n\n---\nReported by **zx (Jace)** — GitHub: @manus-use\n\n## Affected packages\n\n- `phpoffice/phpspreadsheet >= 4.0.0, <= 5.9.0`\n- `phpoffice/phpspreadsheet >= 3.3.0, <= 3.10.7`\n- `phpoffice/phpspreadsheet >= 2.2.0, <= 2.4.7`\n- `phpoffice/phpspreadsheet >= 2.0.0, <= 2.1.18`\n- `phpoffice/phpspreadsheet <= 1.30.6`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `phpoffice/phpspreadsheet 5.10.0`\n- `phpoffice/phpspreadsheet 3.10.8`\n- `phpoffice/phpspreadsheet 2.4.8`\n- `phpoffice/phpspreadsheet 2.1.19`\n- `phpoffice/phpspreadsheet 1.30.7`","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":35.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}