PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading

Not analysed yet

We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.

Severity and exploitation

• CISA KEV Not listed.
• EPSS 0.0034, the 27th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

1. 31 Oct 2026, 13:53 UTC First seen by agentprime
2. 31 Oct 2026, 13:53 UTC Confirmed by OSV

Sources

• GitHub Advisory Database: GHSA-2phh-27fw-q4gc
• OSV: GHSA-2phh-27fw-q4gc
• github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-2phh-27fw-q4gc
• nvd.nist.gov/vuln/detail/CVE-2026-108360
• github.com/PHPOffice/PhpSpreadsheet/commit/299993894dce37aa3b64aa23e9a3f4bb77ab0e66
• github.com/PHPOffice/PhpSpreadsheet/commit/94590951d76a250a5fc1ecf69a0b3f7439a9af49
• github.com/PHPOffice/PhpSpreadsheet/commit/980b5c294493856f1a25754f1e8a1d2185b93738
• github.com/PHPOffice/PhpSpreadsheet/commit/9a0b48622ebfe93fa48cb9bc09ce57303bb07af9
• github.com/PHPOffice/PhpSpreadsheet/commit/da13f40e8760d599b0e8a296017d4b028b20e86c
• github.com/PHPOffice/PhpSpreadsheet
• github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.7
• github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.19
• github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.8
• github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.8

Facts on this page come from the GitHub Advisory Database (CC-BY 4.0), OSV and the other sources listed, as published. We don’t reproduce full advisory descriptions, which can contain exploit code.