CVE-2026-59931
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
PhpSpreadsheet in many versions is vulnerable to SSRF via bypass of the WEBSERVICE() domain whitelist. The webService() function validates the URL host against the whitelist, but PHP automatically follows HTTP 301/302 redirects and the redirect target is not re-validated. An attacker can upload an XLSX file that, when the WEBSERVICE() formula is calculated, causes access to arbitrary URLs, including internal addresses.
Risk Assessment
An attacker can access cloud metadata (AWS/GCP/Azure), internal services, and perform internal port scanning, potentially leading to data exfiltration and further attacks.
Recommendation
Update PhpSpreadsheet to one of the fixed versions: 5.8.1, 3.10.7, 2.4.7, 2.1.18, or 1.30.6.
Other vulnerabilities in PhpSpreadsheet
See all- CVE-2026-40902High
In the PhpSpreadsheet library prior to versions 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, there is a vulnerability in the ColumnAndRowAttributes::readRowAttributes() method that does not validate row numbers in XLSX files against the maximum row limit. An attacker can craft an XLSX file that causes excessive CPU load during row iteration.
- CVE-2026-40863High
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. In versions prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the SpreadsheetML XML reader does not validate the ss:Index row attribute against the maximum allowed row count, which can lead to CPU exhaustion and denial of service.
- CVE-2026-45034Critical
PhpSpreadsheet prior to version 1.30.5 contained a vulnerability that allowed bypassing stream wrapper security checks, potentially leading to remote code execution (RCE). The issue stemmed from improper URL scheme validation, enabling attackers to exploit wrappers like phar://.
- CVE-2026-34084Critical
PhpSpreadsheet in multiple versions (up to 1.30.2, 2.0.0-2.1.14, 2.2.0-2.4.3, 3.3.0-3.10.3, 4.0.0-5.5.0) is vulnerable to Remote Code Execution (RCE) via a user-controlled filename argument in IOFactory::load(). An attacker can supply a PHP stream wrapper path (e.g., phar://, ftp://, ssh2.sftp://) that passes the is_file() check in File::assertFile(). The phar:// wrapper triggers deserialization of PHAR metadata, potentially leading to RCE if a suitable gadget is available.
- CVE-2026-59932High
PhpSpreadsheet in multiple versions (4.0.0-5.8.0, 3.3.0-3.10.6, 2.2.0-2.4.6, 2.0.0-2.1.17, and all up to 1.30.5) contains a vulnerability in the Gnumeric reader. The reader reads attacker-supplied .gnumeric files into memory and, when the file starts with gzip magic bytes, calls gzdecode() on the full compressed contents without enforcing a decompressed-size limit. A very small compressed .gnumeric file can expand to data larger than the PHP memory limit and crash the process during Gnumeric::canRead() before the file is rejected or fully parsed. This is reachable through normal file-type detection and Gnumeric loading paths, so applications that accept attacker-controlled spreadsheet uploads can suffer denial of service.
- CVE-2026-59933High
PhpSpreadsheet in many versions is vulnerable to a DoS attack via OLE file reading. The OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles. A tiny malformed .xls file can cause the reader to repeatedly append the same sector data until PHP memory is exhausted.
- CVE-2026-35453Medium
In PhpSpreadsheet versions 1.30.3 and earlier, 2.0.0-2.1.15, 2.2.0-2.4.4, 3.3.0-3.10.4, and 4.0.0-5.6.0, the HTML Writer skips htmlspecialchars() escaping when a cell uses a custom number format containing @ with literals. An attacker controlling cell content can inject HTML and JavaScript.
Original NVD description (English source)
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE() domain whitelist can be bypassed via an HTTP redirect (SSRF). In Calculation/Web/Service.php, the webService() method validates a URL's host against the whitelist set via Spreadsheet::setDomainWhiteList(), then fetches content with file_get_contents($url, false, $ctx); because PHP's HTTP stream wrapper follows 301/302 redirects automatically (up to 20 hops) and the redirect target is never re-validated, an attacker who can trigger a redirect from a whitelisted domain can reach arbitrary URLs, including internal addresses. An attacker able to upload XLSX files to an application that uses setDomainWhiteList() and getCalculatedValue() can achieve a full-read SSRF, returning up to 32,767 bytes of the response body as a cell's calculated value, which enables exfiltration of cloud metadata (AWS/GCP/Azure credentials via http://169.254.169.254/), access to internal-only services, and internal port scanning (the port is not validated). This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6.