CVE-2026-59931

Name of the Vulnerable Software and Affected Versions PhpSpreadsheet versions 4.0.0 through 5.8.0 PhpSpreadsheet versions 3.3.0 through 3.10.6 PhpSpreadsheet versions 2.2.0 through 2.4.6 PhpSpreadsheet versions 2.0.0 through 2.1.17 PhpSpreadsheet versions prior to 1.30.6

Description Insufficient server-side request validation in the webService() function within the Calculation/Web/Service.php script allows for a Server-Side Request Forgery (SSRF). The issue occurs because the domain whitelist set via setDomainWhiteList() is bypassed when PHP's HTTP stream wrapper automatically follows 301/302 redirects without re-validating the redirect target. An attacker who can upload XLSX files to an application using setDomainWhiteList() and getCalculatedValue() can trigger redirects from a whitelisted domain to reach arbitrary internal URLs. This can lead to the exfiltration of cloud metadata (such as AWS, GCP, or Azure credentials via http://169.254.169.254/), access to internal-only services, and internal port scanning, returning up to 32,767 bytes of the response body as a cell's calculated value.

Recommendations Update PhpSpreadsheet versions 4.0.0 through 5.8.0 to version 5.8.1 Update PhpSpreadsheet versions 3.3.0 through 3.10.6 to version 3.10.7 Update PhpSpreadsheet versions 2.2.0 through 2.4.6 to version 2.4.7 Update PhpSpreadsheet versions 2.0.0 through 2.1.17 to version 2.1.18 Update PhpSpreadsheet versions prior to 1.30.6 to version 1.30.6