CVE-2026-59931: PHPSpreadsheet SSRF Bypass via HTTP Redirect in WEBSERVICE() Domain Whitelist
Summary
CVE-2026-59931: PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist. Affects phpoffice/phpspreadsheet across 5 version ranges.
< 1.30.6
>= 2.0.0, < 2.1.18
>= 2.2.0, < 2.4.7
>= 3.3.0, < 3.10.7
>= 4.0.0, < 5.8.1
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHPSpreadsheet is a popular library for reading and writing spreadsheet files in PHP. It provides a wide range of functionalities, including the ability to fetch data from external sources using the WEBSERVICE() formula. The library introduced a domain whitelist feature in version 5.4.0 to enhance security by restricting which domains can be accessed. However, this feature is vulnerable to a Server-Side Request Forgery (SSRF) attack due to improper handling of HTTP redirects.
Vulnerability Detail
The vulnerability arises from the domain whitelist mechanism in the WEBSERVICE() function, which only checks the initial URL's hostname against a whitelist. When a whitelisted domain issues an HTTP redirect (301/302), the PHP function file_get_contents() follows the redirect without re-validating the target URL against the whitelist. This allows attackers to exploit the vulnerability by redirecting requests to internal services or arbitrary URLs, potentially exposing sensitive data or internal APIs.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.30.61.30.6composer require phpoffice/phpspreadsheet:1.30.6 -
>= 2.0.0, < 2.1.182.1.18composer require phpoffice/phpspreadsheet:2.1.18 -
>= 2.2.0, < 2.4.72.4.7composer require phpoffice/phpspreadsheet:2.4.7 -
>= 3.3.0, < 3.10.73.10.7composer require phpoffice/phpspreadsheet:3.10.7 -
>= 4.0.0, < 5.8.15.8.1composer require phpoffice/phpspreadsheet:5.8.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, disable redirect following in the stream context by modifying the code as follows:
$ctxArray = [
'http' => [
'user_agent' => '...',
'follow_location' => false,
'max_redirects' => 0,
],
];
This change prevents file_get_contents() from following redirects, mitigating the SSRF risk until the package can be updated.
Conclusion
The CVE-2026-59931 vulnerability in PHPSpreadsheet allows attackers to bypass domain whitelisting through HTTP redirects, posing significant security risks. It is crucial to update to the latest version of the library or implement the suggested workaround to mitigate these risks.
See every vulnerability recorded for phpoffice/phpspreadsheet →
FAQ
Server-Side Request Forgery (SSRF) is a security vulnerability that allows an attacker to send crafted requests from the server to internal or external resources, potentially exposing sensitive data.
If your application uses PHPSpreadsheet versions prior to the patched versions mentioned, it is vulnerable. You can check your application's composer.lock file or use Vulert to monitor for vulnerabilities.
The risks include unauthorized access to internal services, data exfiltration, and potential exposure of sensitive information such as cloud metadata.
Yes, you can use the Vulert playground to check if your application is affected by this vulnerability without requiring any signup.
Implement the provided workaround to disable redirect following in your application until you can update to a secure version.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpoffice/phpspreadsheet.
