CVE-2026-108360

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files

Risk score: 51/100
CVSS: 6.4 v3.1
Exploit chance (30 days): 0.2%
Published: 22 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Worksheet\Drawing::setPath validates only the initial external-image URL with setIsWhitelisted when setAllowExternalImages is enabled. The HTTP stream context permits PHP to follow a redi…
Affected: See advisory
Fix: Upgrade the product to 1.30.7, 2.1.19, 2.4.8, 3.10.8 or 5.10.0 (whichever matches your release line), or later.
Exploitation: No known exploitation

Why it is Yellow

CVSS 6.4 medium
On your watchlist: php

References

Original description

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Worksheet\Drawing::setPath validates only the initial external-image URL with setIsWhitelisted when setAllowExternalImages is enabled. The HTTP stream context permits PHP to follow a redirect without applying the callback to the redirected URL, so a permitted image host can redirect the server to an internal address and cause a blind GET request. The response body is not returned to the attacker because the reader validates the downloaded content as an image and removes the temporary file, but internal GET-driven endpoints, network reachability, and cloud metadata endpoints may be reached. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.

Last activity 22 Oct 2026. Patch Forecast updates every hour.