{"id":"ghsa-ghsa-2phh-27fw-q4gc","seq":1708783,"kind":"advisory","title":"PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading","url":"https://github.com/advisories/GHSA-2phh-27fw-q4gc","permalink":"https://vulnpulse.app/items/ghsa-ghsa-2phh-27fw-q4gc","summary":"影響: composer:phpoffice/phpspreadsheet >= 4.0.0, <= 5.9.0 → 5.10.0, composer:phpoffice/phpspreadsheet >= 3.3.0, <= 3.10.7 → 3.10.8, composer:phpoffice/phpspreadsheet >= 2.2.0, <= 2.4.7 → 2.4.8, composer:phpoffice/phpspreadsheet >= 2.0.0, <= 2.1.18 → 2.1.19, composer:phpoffice/phpspreadsheet <= 1.30.6 → 1.30.7\nPhpSpreadsheet's Worksheet\\Drawing::setPath() validates an external-image URL against an operator-supplied isWhitelisted callback once, on the initial URL only, then fetches it with file_get_contents() using a stream context that does not set follow_location => 0. A whitelisted host that returns an HTTP 302 Location: redirect to an internal target is therefore followed by PHP's HTTP wrapper (default follow_location=1, max_redirects=20) with no re-validation of the redirect hop — defeating the w…","severity":"medium","techs":["php"],"cves":["CVE-2026-108360"],"tags":["GHSA-2phh-27fw-q4gc","phpoffice/phpspreadsheet","phpoffice/phpspreadsheet","phpoffice/phpspreadsheet","phpoffice/phpspreadsheet","phpoffice/phpspreadsheet"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T15:38:39.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}