Junglewise Threat Intelligence

CVE-2026-59931: PHPOffice PhpSpreadsheet SSRF bypass in WEBSERVICE domain whitelist

CVE-2026-59931 · Severity: high · CVSS 7.7 · Published 2026-07-28

Technologies: Phpoffice Phpspreadsheet. Vendors: Phpoffice.

Executive brief

PhpSpreadsheet is a popular library used by web applications to read and write Excel files. A security flaw allows attackers to bypass domain restrictions when the library processes spreadsheet formulas that fetch data from the web. By uploading a specially crafted spreadsheet, an attacker could force the server to access internal systems or cloud metadata, potentially leading to the theft of sensitive credentials or internal network mapping.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in PhpSpreadsheet's WEBSERVICE() formula implementation. While the library includes a domain whitelist feature via Spreadsheet::setDomainWhiteList(), the webService() method in Calculation/Web/Service.php only validates the initial URL's hostname. Because PHP's file_get_contents() follows HTTP 301/302 redirects by default and the library does not re-validate the redirect target, an attacker can bypass the whitelist by using a whitelisted domain that issues a redirect to an internal or restricted address. This allows for full-read SSRF, enabling the exfiltration of up to 32,767 bytes of response data, such as cloud instance metadata (AWS/GCP/Azure) or internal service responses. The issue is fixed by disabling automatic redirect following in the stream context or re-validating each hop.

Affected products

  • PHPOffice PhpSpreadsheet >= 4.0.0, < 5.8.1; >= 3.3.0, < 3.10.7; >= 2.2.0, < 2.4.7; >= 2.0.0, < 2.1.18; < 1.30.6

Timeline

  • 2026-07-12: patched: Security patches released across multiple branches
  • 2026-07-19: advisory: GitHub Security Advisory published
  • 2026-07-28: disclosed: CVE published to NVD

References

Related threats