CVE-2026-59931: PHPOffice PhpSpreadsheet SSRF bypass in WEBSERVICE domain whitelist

CVE-2026-59931 · Severity: high · CVSS 7.7 · Published 2026-07-28

PhpSpreadsheet is a popular library used by web applications to read and write Excel files. A security flaw allows attackers to bypass domain restrictions when the library processes spreadsheet formulas that fetch data from the web. By uploading a specially crafted spreadsheet, an attacker could force the server to access internal systems or cloud metadata, potentially leading to the theft of sensitive credentials or internal network mapping.

Technologies: phpoffice/phpspreadsheet (Packagist), Phpoffice Phpspreadsheet. Vendors: Packagist, Phpoffice.

Quick answers

Is CVE-2026-59931 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59931 being exploited in the wild.
How severe is CVE-2026-59931?
High severity, with a CVSS score of 7.7, published 28 July 2026.
Which products and versions are affected?
phpoffice/phpspreadsheet (Packagist) ECOSYSTEM:introduced=4.0.0,fixed=5.8.1; Phpoffice Phpspreadsheet <= 1.30.5, >= 2.0.0, <= 2.1.17, >= 2.2.0, <= 2.4.6, >= 3.3.0, <= 3.10.6, >= 4.0.0, <= 5.8.0, >= 4.0.0, < 5.8.1; >= 3.3.0, < 3.10.7; >= 2.2.0, < 2.4.7; >= 2.0.0, < 2.1.18; < 1.30.6.
Is there a fix for CVE-2026-59931?
Yes. phpoffice/phpspreadsheet (Packagist): upgrade to 5.8.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59931 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-59931?
Check whether you run phpoffice/phpspreadsheet (Packagist) or Phpoffice Phpspreadsheet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • phpoffice/phpspreadsheet (Packagist): upgrade to 5.8.1 or later
    composer require phpoffice/phpspreadsheet:^5.8.1

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in PhpSpreadsheet's WEBSERVICE() formula implementation. While the library includes a domain whitelist feature via Spreadsheet::setDomainWhiteList(), the webService() method in Calculation/Web/Service.php only validates the initial URL's hostname. Because PHP's file_get_contents() follows HTTP 301/302 redirects by default and the library does not re-validate the redirect target, an attacker can bypass the whitelist by using a whitelisted domain that issues a redirect to an internal or restricted address. This allows for full-read SSRF, enabling the exfiltration of up to 32,767 bytes of response data, such as cloud instance metadata (AWS/GCP/Azure) or internal service responses. The issue is fixed by disabling automatic redirect following in the stream context or re-validating each hop.

Affected products

  • PHPOffice PhpSpreadsheet >= 4.0.0, < 5.8.1; >= 3.3.0, < 3.10.7; >= 2.2.0, < 2.4.7; >= 2.0.0, < 2.1.18; < 1.30.6

Identifiers

  • CVE-2026-59931
  • GHSA-6hq5-7373-42rg

Timeline

  • 2026-07-12: patched: Security patches released across multiple branches
  • 2026-07-19: advisory: GitHub Security Advisory published
  • 2026-07-28: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.