# CVE-2026-59931: PHPOffice PhpSpreadsheet SSRF bypass in WEBSERVICE domain whitelist

Source: https://junglewise.ai/threats/cve-2026-59931-phpoffice-phpspreadsheet-ssrf-bypass-in-webservice-domain  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-59931 · Severity: high · CVSS 7.7 · Published 2026-07-28

PhpSpreadsheet is a popular library used by web applications to read and write Excel files. A security flaw allows attackers to bypass domain restrictions when the library processes spreadsheet formulas that fetch data from the web. By uploading a specially crafted spreadsheet, an attacker could force the server to access internal systems or cloud metadata, potentially leading to the theft of sensitive credentials or internal network mapping.

Technologies: [phpoffice/phpspreadsheet (Packagist)](https://junglewise.ai/threats/technologies/phpoffice-phpspreadsheet), [Phpoffice Phpspreadsheet](https://junglewise.ai/threats/technologies/phpspreadsheet). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Phpoffice](https://junglewise.ai/threats/vendors/phpoffice).

## Quick answers

**Is CVE-2026-59931 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59931 being exploited in the wild.

**How severe is CVE-2026-59931?** High severity, with a CVSS score of 7.7, published 28 July 2026.

**Which products and versions are affected?** phpoffice/phpspreadsheet (Packagist) ECOSYSTEM:introduced=4.0.0,fixed=5.8.1; Phpoffice Phpspreadsheet <= 1.30.5, >= 2.0.0, <= 2.1.17, >= 2.2.0, <= 2.4.6, >= 3.3.0, <= 3.10.6, >= 4.0.0, <= 5.8.0, >= 4.0.0, < 5.8.1; >= 3.3.0, < 3.10.7; >= 2.2.0, < 2.4.7; >= 2.0.0, < 2.1.18; < 1.30.6.

**Is there a fix for CVE-2026-59931?** Yes. phpoffice/phpspreadsheet (Packagist): upgrade to 5.8.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59931 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-59931?** Check whether you run phpoffice/phpspreadsheet (Packagist) or Phpoffice Phpspreadsheet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- phpoffice/phpspreadsheet (Packagist): upgrade to 5.8.1 or later

  ```sh
  composer require phpoffice/phpspreadsheet:^5.8.1
  ```


## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in PhpSpreadsheet's WEBSERVICE() formula implementation. While the library includes a domain whitelist feature via Spreadsheet::setDomainWhiteList(), the webService() method in Calculation/Web/Service.php only validates the initial URL's hostname. Because PHP's file_get_contents() follows HTTP 301/302 redirects by default and the library does not re-validate the redirect target, an attacker can bypass the whitelist by using a whitelisted domain that issues a redirect to an internal or restricted address. This allows for full-read SSRF, enabling the exfiltration of up to 32,767 bytes of response data, such as cloud instance metadata (AWS/GCP/Azure) or internal service responses. The issue is fixed by disabling automatic redirect following in the stream context or re-validating each hop.

## Affected products

- PHPOffice PhpSpreadsheet >= 4.0.0, < 5.8.1; >= 3.3.0, < 3.10.7; >= 2.2.0, < 2.4.7; >= 2.0.0, < 2.1.18; < 1.30.6

## Identifiers

- CVE-2026-59931
- GHSA-6hq5-7373-42rg

## Timeline

- 2026-07-12: patched: Security patches released across multiple branches
- 2026-07-19: advisory: GitHub Security Advisory published
- 2026-07-28: disclosed: CVE published to NVD

## References

- [https://github.com/PHPOffice/PhpSpreadsheet/commit/7ef7b25e8548a6ded79dac74e2e2c7acdac38d8d](https://github.com/PHPOffice/PhpSpreadsheet/commit/7ef7b25e8548a6ded79dac74e2e2c7acdac38d8d)
- [https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6](https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6)
- [https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18](https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18)
- [https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7](https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7)
- [https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7](https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7)
- [https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1](https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1)
- [https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg](https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg)

## Related threats

- [PHPOffice PhpSpreadsheet redirect validation bypass in external image loading](https://junglewise.ai/threats/cve-2026-108360-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing)
- [PhpSpreadsheet denial-of-service via unbounded row repetition](https://junglewise.ai/threats/cve-2026-108359-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing)
- [PhpSpreadsheet XmlScanner XML entity expansion denial of service](https://junglewise.ai/threats/cve-2026-108358-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing)
- [PHPOffice PhpSpreadsheet XML entity expansion denial of service](https://junglewise.ai/threats/cve-2026-108357-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing)
- [MediaWiki DataTransfer Extension uncontrolled resource consumption](https://junglewise.ai/threats/cve-2026-100242-dependency-on-vulnerable-third-party-component-and-uncontrolled)