CVE-2026-59931 PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
Attackers can bypass domain whitelists in PhpSpreadsheet via HTTP redirects to perform Server-Side Request Forgery, accessing internal services and cloud metadata.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59931?
CVE-2026-59931 is a high-severity server-side request forgery vulnerability in PHPOffice PhpSpreadsheet, published on 28 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE() domain whitelist can be bypassed via an HTTP redirect (SSRF). In Calculation/Web/Service.php, the webService() method validates a URL's host against the whitelist set via Spreadsheet::setDomainWhiteList(), then fetches content with file_get_contents($url, false, $ctx); because PHP's HTTP stream wrapper follows 301/302 redirects automatically (up to 20 hops) and the redirect target is never re-validated, an attacker who can trigger a redirect from a whitelisted domain can reach arbitrary URLs, including internal addresses. An attacker able to upload XLSX files to an application that uses setDomainWhiteList() and getCalculatedValue() can achieve a full-read SSRF, returning up to 32,767 bytes of the response body as a cell's calculated value, which enables exfiltration of cloud metadata (AWS/GCP/Azure credentials via http://169.254.169.254/), access to internal-only services, and internal port scanning (the port is not validated). This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6.
Weakness: CWE-918
Which versions are affected by CVE-2026-59931?
10 open source packages ship an affected version, including phpoffice/phpspreadsheet.
| Package | Affected | Fixed in |
|---|---|---|
phpoffice/phpspreadsheet Packagist | All versions | 1.30.6 |
phpoffice/phpspreadsheet Packagist | All versions | 1.30.6 |
phpoffice/phpspreadsheet Packagist | From 2.0.0 | 2.1.18 |
phpoffice/phpspreadsheet Packagist | From 2.0.0 | 2.1.18 |
phpoffice/phpspreadsheet Packagist | From 2.2.0 | 2.4.7 |
phpoffice/phpspreadsheet Packagist | From 2.2.0 | 2.4.7 |
4 more packages
phpoffice/phpspreadsheet Packagist | From 3.3.0 | 3.10.7 |
phpoffice/phpspreadsheet Packagist | From 3.3.0 | 3.10.7 |
phpoffice/phpspreadsheet Packagist | From 4.0.0 | 5.8.1 |
phpoffice/phpspreadsheet Packagist | From 4.0.0 | 5.8.1 |
How do I fix CVE-2026-59931?
Upgrade phpoffice/phpspreadsheet to a fixed version for your release line: 1.30.6, 2.1.18, 2.4.7 or 3.10.7.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-59931 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-59931 exists.
Sources
Also known as GHSA-6hq5-7373-42rg.