CVE-2026-108360: CWE-863: Incorrect Authorization in PHPOffice PhpSpreadsheet

PhpSpreadsheet versions before 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0 contain an incorrect authorization vulnerability (CWE-863) in the Worksheet\Drawing::setPath method. When setAllowExternalImages is enabled, only the initial external image URL is validated against a whitelist. Due to the HTTP stream context allowing PHP to follow redirects without reapplying the whitelist callback, an attacker can cause the server to follow redirects to internal network addresses or cloud metadata endpoints, resulting in blind GET requests. The downloaded content is validated as an image and temporary files are removed, so no data is returned to the attacker. The vulnerability is fixed in the versions listed.

An attacker can exploit this vulnerability to cause the server to make blind HTTP GET requests to internal network resources or cloud metadata endpoints by leveraging redirect behavior in external image URLs. While the attacker does not receive the response content, this can reveal network reachability and potentially access sensitive internal services. The vulnerability does not allow direct data exfiltration or denial of service but can be used for internal network reconnaissance.

This vulnerability is fixed in PhpSpreadsheet versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0. Users should upgrade to these or later versions to remediate the issue. No additional mitigation steps are indicated by the vendor advisory.