CVE-2026-59931

{
  "id": "CVE-2026-59931",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-28T18:17:22.873",
  "lastModified": "2026-10-23T23:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE() domain whitelist can be bypassed via an HTTP redirect (SSRF). In Calculation/Web/Service.php, the webService() method validates a URL's host against the whitelist set via Spreadsheet::setDomainWhiteList(), then fetches content with file_get_contents($url, false, $ctx); because PHP's HTTP stream wrapper follows 301/302 redirects automatically (up to 20 hops) and the redirect target is never re-validated, an attacker who can trigger a redirect from a whitelisted domain can reach arbitrary URLs, including internal addresses. An attacker able to upload XLSX files to an application that uses setDomainWhiteList() and getCalculatedValue() can achieve a full-read SSRF, returning up to 32,767 bytes of the response body as a cell's calculated value, which enables exfiltration of cloud metadata (AWS/GCP/Azure credentials via http://169.254.169.254/), access to internal-only services, and internal port scanning (the port is not validated). This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6."
    },
    {
      "lang": "es",
      "value": "PhpSpreadsheet es una biblioteca PHP pura para leer y escribir archivos de hoja de cálculo. En las versiones 4.0.0 a 5.8.0, 3.3.0 a 3.10.6, 2.2.0 a 2.4.6, 2.0.0 a 2.1.17, y todas las versiones hasta la 1.30.5 inclusive, la lista blanca de dominios de WEBSERVICE() puede ser evadida a través de una redirección HTTP (SSRF). En Calculation/Web/Service.php, el método webService() valida el host de una URL contra la lista blanca establecida a través de Spreadsheet::setDomainWhiteList(), luego obtiene el contenido con file_get_contents($url, false, $ctx); debido a que el envoltorio de flujo HTTP de PHP sigue las redirecciones 301/302 automáticamente (hasta 20 saltos) y el objetivo de la redirección nunca se revalida, un atacante que puede activar una redirección desde un dominio en la lista blanca puede alcanzar URLs arbitrarias, incluyendo direcciones internas. Un atacante capaz de subir archivos XLSX a una aplicación que utiliza setDomainWhiteList() y getCalculatedValue() puede lograr un SSRF de lectura completa, devolviendo hasta 32.767 bytes del cuerpo de la respuesta como valor calculado de una celda, lo que permite la exfiltración de metadatos de la nube (credenciales de AWS/GCP/Azure a través de http://169.254.169.254/), el acceso a servicios solo internos y el escaneo de puertos internos (el puerto no se valida). Este problema ha sido solucionado en las versiones 5.8.1, 3.10.7, 2.4.7, 2.1.18 y 1.30.6."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "PHPOffice",
          "product": "PhpSpreadsheet",
          "versions": [
            {
              "version": ">= 4.0.0, < 5.8.1",
              "status": "affected"
            },
            {
              "version": ">= 3.3.0, < 3.10.7",
              "status": "affected"
            },
            {
              "version": ">= 2.2.0, < 2.4.7",
              "status": "affected"
            },
            {
              "version": ">= 2.0.0, < 2.1.18",
              "status": "affected"
            },
            {
              "version": "< 1.30.6",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-28T18:13:13.134222Z",
          "id": "CVE-2026-59931",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/7ef7b25e8548a6ded79dac74e2e2c7acdac38d8d",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}