{"schema":"threatline.record/2","record":{"id":"CVE-2026-108360","aliases":["GHSA-2phh-27fw-q4gc"],"summary":"PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading","details":"PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Worksheet\\Drawing::setPath validates only the initial external-image URL with setIsWhitelisted when setAllowExternalImages is enabled. The HTTP stream context permits PHP to follow a redirect without applying the callback to the redirected URL, so a permitted image host can redirect the server to an internal address and cause a blind GET request. The response body is not returned to the attacker because the reader validates the downloaded content as an image and removes the temporary file, but internal GET-driven endpoints, network reachability, and cloud metadata endpoints may be reached. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.","categories":["Unclassified"],"product":"PhpSpreadsheet","vendor":"PHPOffice","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-108360","source_modified_at":"2026-10-22T17:26:59.148Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"PhpSpreadsheet","vendor":"PHPOffice","versions":[{"status":"affected","version":"< 1.30.7"},{"status":"affected","version":">= 2.0.0, < 2.1.19"},{"status":"affected","version":">= 2.2.0, < 2.4.8"},{"status":"affected","version":">= 3.3.0, < 3.10.8"},{"status":"affected","version":">= 4.0.0, < 5.10.0"}],"defaultStatus":null},{"source":"GitHub Advisory Database","source_url":"https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-2phh-27fw-q4gc","source_modified_at":"2026-10-12T20:56:43Z","fetched_at":"2026-10-24T10:48:42.330819Z","package":{"ecosystem":"composer","name":"phpoffice/phpspreadsheet"},"range":">= 4.0.0, <= 5.9.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-2phh-27fw-q4gc","source_modified_at":"2026-10-12T20:56:43Z","fetched_at":"2026-10-24T10:48:42.330819Z","package":{"ecosystem":"composer","name":"phpoffice/phpspreadsheet"},"range":">= 3.3.0, <= 3.10.7"},{"source":"GitHub Advisory Database","source_url":"https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-2phh-27fw-q4gc","source_modified_at":"2026-10-12T20:56:43Z","fetched_at":"2026-10-24T10:48:42.330819Z","package":{"ecosystem":"composer","name":"phpoffice/phpspreadsheet"},"range":">= 2.2.0, <= 2.4.7"},{"source":"GitHub Advisory Database","source_url":"https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-2phh-27fw-q4gc","source_modified_at":"2026-10-12T20:56:43Z","fetched_at":"2026-10-24T10:48:42.330819Z","package":{"ecosystem":"composer","name":"phpoffice/phpspreadsheet"},"range":">= 2.0.0, <= 2.1.18"},{"source":"GitHub Advisory Database","source_url":"https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-2phh-27fw-q4gc","source_modified_at":"2026-10-12T20:56:43Z","fetched_at":"2026-10-24T10:48:42.330819Z","package":{"ecosystem":"composer","name":"phpoffice/phpspreadsheet"},"range":"<= 1.30.6"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-2phh-27fw-q4gc","source_modified_at":"2026-10-12T20:56:43Z","fetched_at":"2026-10-24T10:48:42.330819Z","package":{"ecosystem":"composer","name":"phpoffice/phpspreadsheet"},"version":"5.10.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-2phh-27fw-q4gc","source_modified_at":"2026-10-12T20:56:43Z","fetched_at":"2026-10-24T10:48:42.330819Z","package":{"ecosystem":"composer","name":"phpoffice/phpspreadsheet"},"version":"3.10.8"},{"source":"GitHub Advisory Database","source_url":"https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-2phh-27fw-q4gc","source_modified_at":"2026-10-12T20:56:43Z","fetched_at":"2026-10-24T10:48:42.330819Z","package":{"ecosystem":"composer","name":"phpoffice/phpspreadsheet"},"version":"2.4.8"},{"source":"GitHub Advisory Database","source_url":"https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-2phh-27fw-q4gc","source_modified_at":"2026-10-12T20:56:43Z","fetched_at":"2026-10-24T10:48:42.330819Z","package":{"ecosystem":"composer","name":"phpoffice/phpspreadsheet"},"version":"2.1.19"},{"source":"GitHub Advisory Database","source_url":"https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-2phh-27fw-q4gc","source_modified_at":"2026-10-12T20:56:43Z","fetched_at":"2026-10-24T10:48:42.330819Z","package":{"ecosystem":"composer","name":"phpoffice/phpspreadsheet"},"version":"1.30.7"}],"cvss":6.4,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00221,"percentile":0.12007,"score_date":"2026-10-23"},"published_at":"2026-10-22T17:26:59.148Z","modified_at":"2026-10-22T17:26:59.148Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-108360","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-22T17:26:59.148Z"},{"source":"GitHub Advisory Database","url":"https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-2phh-27fw-q4gc","fetched_at":"2026-10-24T10:48:42.330819Z","source_modified_at":"2026-10-12T20:56:43Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108360","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","GitHub Advisory Database","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-2phh-27fw-q4gc","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/PHPOffice/PhpSpreadsheet/commit/299993894dce37aa3b64aa23e9a3f4bb77ab0e66","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/PHPOffice/PhpSpreadsheet/commit/94590951d76a250a5fc1ecf69a0b3f7439a9af49","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/PHPOffice/PhpSpreadsheet/commit/980b5c294493856f1a25754f1e8a1d2185b93738","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/PHPOffice/PhpSpreadsheet/commit/9a0b48622ebfe93fa48cb9bc09ce57303bb07af9","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/PHPOffice/PhpSpreadsheet/commit/da13f40e8760d599b0e8a296017d4b028b20e86c","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.7","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.19","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.8","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.8","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.10.0","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-22T17:26:59.148Z","content_hash":"1daaf6ed83677779eb949460e71d8804219511b0ce7ab4bcd1aab7fff5dac738"}}