CVE-2026-59931: PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
The domain whitelist introduced in PhpSpreadsheet 5.4.0 for the WEBSERVICE() formula function can be bypassed via HTTP redirect. The whitelist validates only the initial URL’s hostname, but file_get_contents() follows 302/301 redirects by default without re-validating the redirect target against the whitelist. This allows an attacker to reach internal services through a whitelisted domain that issues an HTTP redirect.
References
- github.com/PHPOffice/PhpSpreadsheet/commit/7ef7b25e8548a6ded79dac74e2e2c7acdac38d8d
- github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6
- github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18
- github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7
- github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7
- github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1
- github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg
- github.com/advisories/GHSA-6hq5-7373-42rg
- nvd.nist.gov/vuln/detail/CVE-2026-59931
Code Behaviors & Features
Detect and mitigate CVE-2026-59931 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →