Is CVE-2026-108360 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108360 being exploited in the wild.

How severe is CVE-2026-108360?

Medium severity, with a CVSS score of 6.4, published 22 October 2026.

Which products and versions are affected?

phpoffice/phpspreadsheet (Packagist) >= 4.0.0, <= 5.9.0, ECOSYSTEM:introduced=4.0.0,fixed=5.10.0; Phpoffice Phpspreadsheet before 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.

Is there a fix for CVE-2026-108360?

Yes. phpoffice/phpspreadsheet (Packagist): upgrade to 5.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-108360 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-108360?

Check whether you run phpoffice/phpspreadsheet (Packagist) or Phpoffice Phpspreadsheet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108360: PHPOffice PhpSpreadsheet redirect validation bypass in external image loading

Q: Is there a fix for CVE-2026-108360?

Yes. phpoffice/phpspreadsheet (Packagist): upgrade to 5.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-108360 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-108360?

Check whether you run phpoffice/phpspreadsheet (Packagist) or Phpoffice Phpspreadsheet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108360 · Severity: medium · CVSS 6.4 · Published 2026-10-22

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. When enabled to load external images, it validates only the initial image URL but fails to re-validate after HTTP redirects, allowing an attacker to redirect a permitted image host to internal addresses. This could enable blind requests to internal services, cloud metadata endpoints, or other network endpoints, potentially exposing sensitive information or internal infrastructure details.

Technologies: phpoffice/phpspreadsheet (Packagist), Phpoffice Phpspreadsheet. Vendors: Packagist, Phpoffice.

Quick answers

Is CVE-2026-108360 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108360 being exploited in the wild.
How severe is CVE-2026-108360?: Medium severity, with a CVSS score of 6.4, published 22 October 2026.
Which products and versions are affected?: phpoffice/phpspreadsheet (Packagist) >= 4.0.0, <= 5.9.0, ECOSYSTEM:introduced=4.0.0,fixed=5.10.0; Phpoffice Phpspreadsheet before 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.
Is there a fix for CVE-2026-108360?: Yes. phpoffice/phpspreadsheet (Packagist): upgrade to 5.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-108360 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-108360?: Check whether you run phpoffice/phpspreadsheet (Packagist) or Phpoffice Phpspreadsheet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

phpoffice/phpspreadsheet (Packagist): upgrade to 5.10.0 or later
```
composer require phpoffice/phpspreadsheet:^5.10.0
```

Technical details

The Worksheet\Drawing::setPath method validates external image URLs only once via setIsWhitelisted when setAllowExternalImages is enabled, but PHP's HTTP stream context follows redirects without re-applying the whitelist validation. An attacker controlling a whitelisted image host can respond with a redirect to an internal IP or cloud metadata endpoint, causing the server to make a blind GET request. While the response body is not returned to the attacker due to image content validation, the request itself occurs, potentially allowing endpoint discovery or metadata retrieval.

Affected products

PHPOffice PhpSpreadsheet before 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0

Identifiers

CVE-2026-108360
GHSA-2phh-27fw-q4gc

Timeline

2026-10-22: disclosed
2026-09-15: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.