SSRF Bypass in PhpSpreadsheet Affects Multiple Versions
CVE-2026-59931
7.7HIGH
What is CVE-2026-59931?
In PhpSpreadsheet, versions up to 5.8.0 contain a vulnerability that allows Server-Side Request Forgery (SSRF) via a bypass of the WEBSERVICE() domain whitelist. This vulnerability arises because the library does not re-validate the URL's host after following HTTP redirects. An attacker can exploit this flaw if they can trigger a redirect from a whitelisted domain, potentially accessing sensitive internal services or cloud metadata, including credentials for AWS, GCP, or Azure. Users are advised to upgrade to the patched versions (5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6) to mitigate these risks.
Affected Version(s)
PhpSpreadsheet >= 4.0.0, < 5.8.1 < 4.0.0, 5.8.1
PhpSpreadsheet >= 3.3.0, < 3.10.7 < 3.3.0, 3.10.7
PhpSpreadsheet >= 2.2.0, < 2.4.7 < 2.2.0, 2.4.7