AIKIDO-2026-826397

phpoffice/phpspreadsheet is vulnerable to Server-Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF)CVE-2026-59931 Published Jul 23, 2026

High Risk

This Affects:

phpoffice/phpspreadsheet

0.0.1 - 1.30.5

Fixed in 1.30.6

2.0.0 - 2.1.17

Fixed in 2.1.18

2.2.0 - 2.4.6

Fixed in 2.4.7

3.3.0 - 3.10.6

Fixed in 3.10.7

4.0.0 - 5.8.0

Fixed in 5.8.1

Are you affected? Scan for Free

TL;DR

The WEBSERVICE() calculation function validates a target URL's host against a configured domain whitelist but fetches the content with file_get_contents() while allowing HTTP redirects to be followed. Because redirect targets are not re-validated against the whitelist, an attacker-supplied spreadsheet can point WEBSERVICE() at a whitelisted host that issues a 302 redirect to an internal address. This lets a crafted file reach internal services and read cloud metadata, bypassing the allowlist as a full-read SSRF. The fix disables redirect following in the stream context and returns a not-implemented sentinel for disallowed hosts.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application evaluates the WEBSERVICE() function on untrusted spreadsheets with a configured domain whitelist.

Background info

phpoffice/phpspreadsheet is vulnerable to Server-Side Request Forgery (SSRF) in versions 4.0.0 - 5.8.0, 3.3.0 - 3.10.6, 2.2.0 - 2.4.6, 2.0.0 - 2.1.17 and 0.0.1 - 1.30.5.