‹ Back to list

CVE-2026-108360

Status: Awaiting AnalysisMedium (6.4)—
Severity6.4Medium · CVSS 3.1
Exploitation probability0.22 %higher than 12% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Worksheet\Drawing::setPath validates only the initial external-image URL with setIsWhitelisted when setAllowExternalImages is enabled. The HTTP stream context permits PHP to follow a redirect without applying the callback to the redirected URL, so a permitted image host can redirect the server to an internal address and cause a blind GET request.

Read full descriptionShow less

The response body is not returned to the attacker because the reader validates the downloaded content as an image and removes the temporary file, but internal GET-driven endpoints, network reachability, and cloud metadata endpoints may be reached. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.

CVSS

Base score
6.4
Version
3.1
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days
0.22 %
Percentile among all scored CVEs
12
Score date
10/23/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

El vector AV:N/PR:L/UI:N exige privilegios y el texto describe una redirección que lleva a GET ciego a direcciones internas y metadatos cloud, es decir, SSRF.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Vulnerability ScanningThreat Intelligence ProgramSSL/TLS InspectionPrivileged Account ManagementNetwork SegmentationNetwork Intrusion Prevention

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Phpoffice — PhpspreadsheetAI

CWEs

References

Show 11 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-108360",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 3.1
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "PHPOffice",
          "product": "PhpSpreadsheet",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.30.7"
            },
            {
              "status": "affected",
              "version": ">= 2.0.0, < 2.1.19"
            },
            {
              "status": "affected",
              "version": ">= 2.2.0, < 2.4.8"
            },
            {
              "status": "affected",
              "version": ">= 3.3.0, < 3.10.8"
            },
            {
              "status": "affected",
              "version": ">= 4.0.0, < 5.10.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-22T18:17:26.897",
  "references": [
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/299993894dce37aa3b64aa23e9a3f4bb77ab0e66",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/94590951d76a250a5fc1ecf69a0b3f7439a9af49",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/980b5c294493856f1a25754f1e8a1d2185b93738",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/9a0b48622ebfe93fa48cb9bc09ce57303bb07af9",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/da13f40e8760d599b0e8a296017d4b028b20e86c",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.7",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.19",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.8",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.8",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.10.0",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-2phh-27fw-q4gc",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        },
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Worksheet\\Drawing::setPath validates only the initial external-image URL with setIsWhitelisted when setAllowExternalImages is enabled. The HTTP stream context permits PHP to follow a redirect without applying the callback to the redirected URL, so a permitted image host can redirect the server to an internal address and cause a blind GET request. The response body is not returned to the attacker because the reader validates the downloaded content as an image and removes the temporary file, but internal GET-driven endpoints, network reachability, and cloud metadata endpoints may be reached. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0."
    }
  ],
  "lastModified": "2026-10-23T19:42:24.553",
  "sourceIdentifier": "security-advisories@github.com"
}