Internal URL Redirection Vulnerability in PhpSpreadsheet Library
CVE-2026-108360
6.4MEDIUM
What is CVE-2026-108360?
The PhpSpreadsheet library has a vulnerability in the Worksheet\Drawing::setPath method that improperly validates external image URLs when external image loading is allowed. This weakness can be exploited through HTTP redirects that lead to internal addresses, allowing unauthorized access to internal endpoints and cloud metadata services. Although the response from these internal requests is not sent back to the attacker, it can serve as a gateway for further exploitation. The issue has been addressed in updates 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.
Affected Version(s)
PhpSpreadsheet < 1.30.7 < 1.30.7
PhpSpreadsheet >= 2.0.0, < 2.1.19 < 2.0.0, 2.1.19
PhpSpreadsheet >= 2.2.0, < 2.4.8 < 2.2.0, 2.4.8