CVE-2026-59931

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-59931", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-07T18:20:06.126Z", "datePublished": "2026-07-28T17:27:27.300Z", "dateUpdated": "2026-07-28T18:13:17.566Z"}, "containers": {"cna": {"title": "PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg"}, {"name": "https://github.com/PHPOffice/PhpSpreadsheet/commit/7ef7b25e8548a6ded79dac74e2e2c7acdac38d8d", "tags": ["x_refsource_MISC"], "url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/7ef7b25e8548a6ded79dac74e2e2c7acdac38d8d"}, {"name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6"}, {"name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18", "tags": ["x_refsource_MISC"], "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18"}, {"name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7"}, {"name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7"}, {"name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1"}], "affected": [{"vendor": "PHPOffice", "product": "PhpSpreadsheet", "versions": [{"version": ">= 4.0.0, < 5.8.1", "status": "affected"}, {"version": ">= 3.3.0, < 3.10.7", "status": "affected"}, {"version": ">= 2.2.0, < 2.4.7", "status": "affected"}, {"version": ">= 2.0.0, < 2.1.18", "status": "affected"}, {"version": "< 1.30.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-28T17:27:27.300Z"}, "descriptions": [{"lang": "en", "value": "PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE() domain whitelist can be bypassed via an HTTP redirect (SSRF). In Calculation/Web/Service.php, the webService() method validates a URL's host against the whitelist set via Spreadsheet::setDomainWhiteList(), then fetches content with file_get_contents($url, false, $ctx); because PHP's HTTP stream wrapper follows 301/302 redirects automatically (up to 20 hops) and the redirect target is never re-validated, an attacker who can trigger a redirect from a whitelisted domain can reach arbitrary URLs, including internal addresses. An attacker able to upload XLSX files to an application that uses setDomainWhiteList() and getCalculatedValue() can achieve a full-read SSRF, returning up to 32,767 bytes of the response body as a cell's calculated value, which enables exfiltration of cloud metadata (AWS/GCP/Azure credentials via http://169.254.169.254/), access to internal-only services, and internal port scanning (the port is not validated). This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6."}], "source": {"advisory": "GHSA-6hq5-7373-42rg", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-28T18:13:13.134222Z", "id": "CVE-2026-59931", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-28T18:13:17.566Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-59931", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-28T18:13:13.134222Z"}}}], "references": [{"url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-28T18:12:51.892Z"}}], "cna": {"title": "PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist", "source": {"advisory": "GHSA-6hq5-7373-42rg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "PHPOffice", "product": "PhpSpreadsheet", "versions": [{"status": "affected", "version": ">= 4.0.0, < 5.8.1"}, {"status": "affected", "version": ">= 3.3.0, < 3.10.7"}, {"status": "affected", "version": ">= 2.2.0, < 2.4.7"}, {"status": "affected", "version": ">= 2.0.0, < 2.1.18"}, {"status": "affected", "version": "< 1.30.6"}]}], "references": [{"url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg", "name": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/7ef7b25e8548a6ded79dac74e2e2c7acdac38d8d", "name": "https://github.com/PHPOffice/PhpSpreadsheet/commit/7ef7b25e8548a6ded79dac74e2e2c7acdac38d8d", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6", "name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18", "name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7", "name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7", "name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1", "name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE() domain whitelist can be bypassed via an HTTP redirect (SSRF). In Calculation/Web/Service.php, the webService() method validates a URL's host against the whitelist set via Spreadsheet::setDomainWhiteList(), then fetches content with file_get_contents($url, false, $ctx); because PHP's HTTP stream wrapper follows 301/302 redirects automatically (up to 20 hops) and the redirect target is never re-validated, an attacker who can trigger a redirect from a whitelisted domain can reach arbitrary URLs, including internal addresses. An attacker able to upload XLSX files to an application that uses setDomainWhiteList() and getCalculatedValue() can achieve a full-read SSRF, returning up to 32,767 bytes of the response body as a cell's calculated value, which enables exfiltration of cloud metadata (AWS/GCP/Azure credentials via http://169.254.169.254/), access to internal-only services, and internal port scanning (the port is not validated). This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-28T17:27:27.300Z"}}}, "cveMetadata": {"cveId": "CVE-2026-59931", "state": "PUBLISHED", "dateUpdated": "2026-07-28T18:13:17.566Z", "dateReserved": "2026-07-07T18:20:06.126Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-28T17:27:27.300Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "PhpSpreadsheet", "vendor": "PHPOffice", "versions": [{"status": "affected", "version": ">= 4.0.0, < 5.8.1"}, {"status": "affected", "version": ">= 3.3.0, < 3.10.7"}, {"status": "affected", "version": ">= 2.2.0, < 2.4.7"}, {"status": "affected", "version": ">= 2.0.0, < 2.1.18"}, {"status": "affected", "version": "< 1.30.6"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE() domain whitelist can be bypassed via an HTTP redirect (SSRF). In Calculation/Web/Service.php, the webService() method validates a URL's host against the whitelist set via Spreadsheet::setDomainWhiteList(), then fetches content with file_get_contents($url, false, $ctx); because PHP's HTTP stream wrapper follows 301/302 redirects automatically (up to 20 hops) and the redirect target is never re-validated, an attacker who can trigger a redirect from a whitelisted domain can reach arbitrary URLs, including internal addresses. An attacker able to upload XLSX files to an application that uses setDomainWhiteList() and getCalculatedValue() can achieve a full-read SSRF, returning up to 32,767 bytes of the response body as a cell's calculated value, which enables exfiltration of cloud metadata (AWS/GCP/Azure credentials via http://169.254.169.254/), access to internal-only services, and internal port scanning (the port is not validated). This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6."}, {"lang": "es", "value": "PhpSpreadsheet es una biblioteca PHP pura para leer y escribir archivos de hoja de c\u00e1lculo. En las versiones 4.0.0 a 5.8.0, 3.3.0 a 3.10.6, 2.2.0 a 2.4.6, 2.0.0 a 2.1.17, y todas las versiones hasta la 1.30.5 inclusive, la lista blanca de dominios de WEBSERVICE() puede ser evadida a trav\u00e9s de una redirecci\u00f3n HTTP (SSRF). En Calculation/Web/Service.php, el m\u00e9todo webService() valida el host de una URL contra la lista blanca establecida a trav\u00e9s de Spreadsheet::setDomainWhiteList(), luego obtiene el contenido con file_get_contents($url, false, $ctx); debido a que el envoltorio de flujo HTTP de PHP sigue las redirecciones 301/302 autom\u00e1ticamente (hasta 20 saltos) y el objetivo de la redirecci\u00f3n nunca se revalida, un atacante que puede activar una redirecci\u00f3n desde un dominio en la lista blanca puede alcanzar URLs arbitrarias, incluyendo direcciones internas. Un atacante capaz de subir archivos XLSX a una aplicaci\u00f3n que utiliza setDomainWhiteList() y getCalculatedValue() puede lograr un SSRF de lectura completa, devolviendo hasta 32.767 bytes del cuerpo de la respuesta como valor calculado de una celda, lo que permite la exfiltraci\u00f3n de metadatos de la nube (credenciales de AWS/GCP/Azure a trav\u00e9s de http://169.254.169.254/), el acceso a servicios solo internos y el escaneo de puertos internos (el puerto no se valida). Este problema ha sido solucionado en las versiones 5.8.1, 3.10.7, 2.4.7, 2.1.18 y 1.30.6."}], "id": "CVE-2026-59931", "lastModified": "2026-10-23T23:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59931", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-28T18:13:13.134222Z", "version": "2.0.3"}}]}, "published": "2026-07-28T18:17:22.873", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/7ef7b25e8548a6ded79dac74e2e2c7acdac38d8d"}, {"source": "security-advisories@github.com", "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6"}, {"source": "security-advisories@github.com", "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18"}, {"source": "security-advisories@github.com", "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7"}, {"source": "security-advisories@github.com", "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7"}, {"source": "security-advisories@github.com", "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,5.8.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.3.0,3.10.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.2.0,2.4.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,2.1.18)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.30.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "PhpSpreadsheet", "source": "cna", "vendor": "PHPOffice"}, "product": "phpspreadsheet", "vendor": "phpoffice"}], "created": "2026-07-28T19:45:16.650848+00:00", "updated": "2026-08-03T14:45:04.296526+00:00", "vendors": ["phpoffice", "phpoffice$PRODUCT$phpspreadsheet"]}