Skip to main content

Server-Side Request Forgery (SSRF)

CVE-2026-59931

High
7.7/10

Summary

The domain whitelist introduced in PhpSpreadsheet for the `WEBSERVICE()` formula function can be bypassed via HTTP redirect. The whitelist validates only the initial URL's hostname, but `file_get_contents()` follows 302/301 redirects by default without re-validating the redirect target against the whitelist. This allows an attacker to reach internal services through a whitelisted domain that issues an HTTP redirect. The affected versions are prior to 1.30.6, 2.0.0 prior to 2.1.18, 2.2.0 prior to 2.4.7, 3.3.0 prior to 3.10.7 and 4.0.0 prior to 5.8.1.

  • LOW
  • NETWORK
  • NONE
  • CHANGED
  • NONE
  • LOW
  • HIGH
  • NONE

CWE-918 - Server-Side Request Forgery (SSRF)

Server-side request forgery (SSRF) is a weakness that allows an attacker to send an arbitrary request, making it appear that the request was sent by the server. This request may bypass a firewall that would normally prevent direct access to the URL. The impact of this vulnerability can vary from unauthorized access to files and sensitive information to remote code execution.

References

Advisory Timeline

  • Published