CVE-2026-59931
Received Received - Intake

Server-Side Request Forgery in PhpSpreadsheet

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE() domain whitelist can be bypassed via an HTTP redirect (SSRF). In Calculation/Web/Service.php, the webService() method validates a URL's host against the whitelist set via Spreadsheet::setDomainWhiteList(), then fetches content with file_get_contents($url, false, $ctx); because PHP's HTTP stream wrapper follows 301/302 redirects automatically (up to 20 hops) and the redirect target is never re-validated, an attacker who can trigger a redirect from a whitelisted domain can reach arbitrary URLs, including internal addresses. An attacker able to upload XLSX files to an application that uses setDomainWhiteList() and getCalculatedValue() can achieve a full-read SSRF, returning up to 32,767 bytes of the response body as a cell's calculated value, which enables exfiltration of cloud metadata (AWS/GCP/Azure credentials via http://169.254.169.254/), access to internal-only services, and internal port scanning (the port is not validated). This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-29
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-59931
EUVD
EUVD-2026-49929

Affected Vendors & Products

Showing 18 associated CPEs
Vendor Product Version / Range
phpoffice phpspreadsheet *
phpoffice phpspreadsheet From 1.30.5 (inc) to 5.8.0 (inc)
phpoffice phpspreadsheet 1.30.6
phpoffice phpspreadsheet 2.1.18
phpoffice phpspreadsheet 2.4.7
phpoffice phpspreadsheet 3.10.7
phpoffice phpspreadsheet 5.8.1
phpspreadsheet phpspreadsheet From 1.30.0 (inc) to 5.8.0 (inc)
phpspreadsheet phpspreadsheet to 5.8.0 (inc)
phpspreadsheet phpspreadsheet to 3.10.6 (inc)
phpspreadsheet phpspreadsheet to 2.4.6 (inc)
phpspreadsheet phpspreadsheet to 2.1.17 (inc)
phpspreadsheet phpspreadsheet to 1.30.5 (inc)
phpspreadsheet phpspreadsheet 5.8.1
phpspreadsheet phpspreadsheet 3.10.7
phpspreadsheet phpspreadsheet 2.4.7
phpspreadsheet phpspreadsheet 2.1.18
phpspreadsheet phpspreadsheet 1.30.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in PhpSpreadsheet affecting versions 1.30.5 through 5.8.0. The WEBSERVICE() function uses a domain whitelist but fails to re-validate redirected URLs. Attackers can bypass the whitelist by exploiting HTTP 301/302 redirects from whitelisted domains, enabling access to internal services or cloud metadata.

Detection Guidance

Check PhpSpreadsheet versions in use with commands like 'composer show phpoffice/phpspreadsheet' or 'grep -r "PhpSpreadsheet" /path/to/project'. Monitor network traffic for unexpected outbound connections from applications using PhpSpreadsheet, especially to internal or cloud metadata endpoints (e.g., 169.254.169.254). Review logs for WEBSERVICE() function calls in XLSX files processed by your system.

Impact Analysis

An attacker could upload a malicious XLSX file with a WEBSERVICE formula pointing to a redirect endpoint on a whitelisted domain. This could allow exfiltration of cloud metadata (AWS/GCP/Azure credentials), access to internal-only services, and internal port scanning. The impact includes data breaches and unauthorized network access.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade PhpSpreadsheet to patched versions (5.8.1, 3.10.7, 2.4.7, 2.1.18, or 1.30.6) immediately. Disable WEBSERVICE() functionality if not required. Implement network-level restrictions to block outbound connections to internal or cloud metadata endpoints. Review and restrict file uploads to trusted sources only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59931. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart