PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading
Medium · CVSS 6.4 (GHSA) · fetched 2026-10-27
## Summary PhpSpreadsheet's `Worksheet\Drawing::setPath()` validates an external-image URL against an operator-supplied `isWhitelisted` callback **once**, on the initial URL only, then fetches it with `file_get_contents()` using a stream context that does **not** set `follow_location => 0`. A whitelisted host that returns an HTTP `302 Location:` redirect to an internal target is therefore followed by PHP's HTTP wrapper (default `follow_location=1`, `max_redirects=20`) with **no re-validation of the redirect hop** — defeating the whitelist and yielding a blind SSRF from the server.
Remediation
Upgrade phpoffice/phpspreadsheet to 5.10.0 or later. Upgrade phpoffice/phpspreadsheet to 3.10.8 or later. Upgrade phpoffice/phpspreadsheet to 2.4.8 or later.
Affected PHP branches
See the source advisory.
Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-27T12:20:12-04:00 · https://github.com/advisories/GHSA-2phh-27fw-q4gc