CVE-2026-108360

Name of the Vulnerable Software and Affected Versions PhpSpreadsheet versions prior to 1.30.7 PhpSpreadsheet versions prior to 2.1.19 PhpSpreadsheet versions prior to 2.4.8 PhpSpreadsheet versions prior to 3.10.8 PhpSpreadsheet versions prior to 5.10.0

Description When setAllowExternalImages is enabled, the setPath() function in WorksheetDrawing only validates the initial external-image URL using setIsWhitelisted. Because the HTTP stream context allows PHP to follow redirects without re-applying the validation callback to the new URL, a trusted image host can redirect the server to an internal address. This leads to a blind GET request, potentially allowing access to internal GET-driven endpoints, network reachability tests, and cloud metadata endpoints. The response body is not leaked to the attacker as the system validates the content as an image and deletes the temporary file.

Recommendations Update to version 1.30.7 or later. Update to version 2.1.19 or later. Update to version 2.4.8 or later. Update to version 3.10.8 or later. Update to version 5.10.0 or later.