CVE-2026-108360: 
PHP vulnerability analysis and mitigation

CVE-2026-108360 is an SSRF whitelist bypass vulnerability in PhpSpreadsheet's Worksheet\Drawing::setPath() method, caused by unvalidated HTTP redirects during external image loading. An attacker can craft a malicious spreadsheet that references a whitelisted host which then redirects to an internal target, bypassing the operator-supplied whitelist callback entirely. Affected versions span multiple release branches: <= 1.30.6, >= 2.0.0 <= 2.1.18, >= 2.2.0 <= 2.4.7, >= 3.3.0 <= 3.10.7, and >= 4.0.0 <= 5.9.0. It was published on October 12, 2026, with a CVSS v3.1 score of 6.4 (Moderate) (GitHub Advisory).

The root cause is an incomplete fix for a prior SSRF vulnerability (CVE-2026-59931): the follow_location => 0 mitigation was applied only to Calculation/Web/Service.php but never to Worksheet/Drawing.php (CWE-918, CWE-863). In Drawing::setPath(), the operator-supplied $isWhitelisted callback validates the initial URL at line 131, but the stream context built at lines 140–152 omits follow_location, so PHP's HTTP wrapper follows redirects by default (follow_location=1, up to 20 hops) without re-invoking the whitelist check. The sink is file_get_contents($path, false, $ctx) at line 154, which issues the redirected GET request to the internal target. Exploitation requires setAllowExternalImages(true) to be enabled by the application and a whitelisted host under attacker influence that returns an HTTP 302 redirect to an internal resource (GitHub Advisory).

Successful exploitation yields a blind server-side GET primitive against internal network resources, including cloud metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/), internal HTTP services, and allows coarse port/reachability probing. The response body is written to a temporary file, checked with isImage(), and then deleted — meaning the response content is not directly exfiltrated, making this a blind SSRF rather than a full read primitive. The scope change (CVSS S:C) reflects that the vulnerable component can be used to reach resources outside its security boundary, with low confidentiality and integrity impact (GitHub Advisory).

No public exploit kit or weaponized tooling has been reported at this time, though a detailed proof-of-concept attack chain is included in the GitHub Security Advisory. Exploitation requires the victim application to have setAllowExternalImages(true) configured and a whitelisted host that the attacker can control or influence to issue a redirect. There is no current evidence of in-the-wild exploitation, and the vulnerability has not been added to the CISA KEV catalog. EPSS score data is not yet available for this CVE (GitHub Advisory).

1. Identify a target: Find an application using PhpSpreadsheet with setAllowExternalImages(true) and an isWhitelisted callback that permits a host the attacker can influence (e.g., trusted-whitelisted.example).
2. Set up redirect server: Configure the whitelisted host (or a compromised resource at that host) to return an HTTP 302 redirect from a path like /redir.png to an internal target such as http://169.254.169.254/latest/meta-data/.
3. Craft malicious spreadsheet: Create an evil.xlsx file with an external drawing relationship in xl/drawings/_rels/drawing1.xml.rels pointing to https://trusted-whitelisted.example/redir.png with TargetMode="External".
4. Deliver the file: Induce the victim application to load the crafted spreadsheet (e.g., via file upload, email attachment, or API endpoint).
5. Trigger SSRF: When the application calls $reader->load('evil.xlsx'), Drawing::setPath() validates the initial URL (whitelisted), then file_get_contents() follows the 302 redirect to the internal target without re-validation, issuing a blind GET to the internal resource.
6. Observe side effects: Monitor for timing differences, error messages, or behavioral changes in the application that may reveal internal reachability or metadata endpoint responses (GitHub Advisory).

• Network: Outbound HTTP GET requests from the application server to internal IP ranges (e.g., 169.254.169.254, RFC-1918 addresses) or cloud metadata endpoints, originating from the PHP process.
• Network: Outbound requests to a whitelisted external host immediately followed by a redirect-triggered request to an internal host within the same TCP session or short time window.
• Logs: Web server or application logs showing spreadsheet file uploads or processing events correlated with unexpected outbound HTTP requests in server-side logs.
• File System: Temporary files created and immediately deleted in the system temp directory during spreadsheet processing, consistent with the isImage() check and temp file cleanup in Drawing::setPath().
• Process: PHP worker processes making unexpected outbound network connections to internal addresses during spreadsheet parsing operations (GitHub Advisory).

Patched versions have been released across all affected branches: 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0. The fix mirrors the CVE-2026-59931 patch by adding 'follow_location' => 0 (and/or 'max_redirects' => 0) to the HTTP stream context in Drawing::setPath(), and/or re-running the $isWhitelisted callback on each redirect hop. As an immediate workaround, operators should avoid enabling setAllowExternalImages(true) unless strictly necessary, and should ensure the isWhitelisted callback is as restrictive as possible. Upgrading to a patched version is the recommended remediation (GitHub Advisory).