{"items":[{"id":"NVI-00006357","kind":"vulnerability","title":"PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-6hq5-7373-42rg","CVE-2026-59931"],"plain_summary":"OSV carries this publisher advisory for phpoffice/phpspreadsheet, phpoffice/phpspreadsheet, phpoffice/phpspreadsheet, phpoffice/phpspreadsheet, phpoffice/phpspreadsheet. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 5.8.1 for phpoffice/phpspreadsheet. Confirm the publisher’s latest guidance.","source_ids":["sr-b14ed58cd658b2d7cfb1941f0879330d"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 3.10.7 for phpoffice/phpspreadsheet. Confirm the publisher’s latest guidance.","source_ids":["sr-b14ed58cd658b2d7cfb1941f0879330d"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 2.4.7 for phpoffice/phpspreadsheet. Confirm the publisher’s latest guidance.","source_ids":["sr-b14ed58cd658b2d7cfb1941f0879330d"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 2.1.18 for phpoffice/phpspreadsheet. Confirm the publisher’s latest guidance.","source_ids":["sr-b14ed58cd658b2d7cfb1941f0879330d"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 1.30.6 for phpoffice/phpspreadsheet. Confirm the publisher’s latest guidance.","source_ids":["sr-b14ed58cd658b2d7cfb1941f0879330d"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-4da7c3357cad0e95586b58f345a90ff2"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-23T23:10:00.157Z","value":"7.7 HIGH (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-00f9b64ce2bec334b9aa687108be4b22"},{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.474%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.40977. Missing scores are unknown.","source_id":"sr-4da7c3357cad0e95586b58f345a90ff2"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-b14ed58cd658b2d7cfb1941f0879330d","url":"https://github.com/advisories/GHSA-6hq5-7373-42rg","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-6hq5-7373-42rg","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:59.936Z"},{"id":"sr-00f9b64ce2bec334b9aa687108be4b22","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59931","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-59931","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-01T07:24:39.943Z"},{"id":"sr-4da7c3357cad0e95586b58f345a90ff2","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-59931","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:15.383Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-b14ed58cd658b2d7cfb1941f0879330d"],"technology":"phpoffice/phpspreadsheet","known_exclusions":[],"conditions_summary":"### Summary\n\nThe domain whitelist introduced in PhpSpreadsheet 5.4.0 for the `WEBSERVICE()` formula function can be bypassed via HTTP redirect. The whitelist validates only the initial URL's hostname, but `file_get_contents()` follows 302/301 redirects by default without re-validating the redirect target against the whitelist. This allows an attacker to reach internal services through a whitelisted domain that issues an HTTP redirect.\n\n### Details\n\nIn `Calculation/Web/Service.php`, the `webService()` method validates the URL's host against a domain whitelist set via `Spreadsheet::setDomainWhiteList()`. If the host passes validation, the method calls `file_get_contents($url, false, $ctx)` to fetch the content.\n\nThe stream context does not disable redirect following:\n\n```php\n$ctxArray = [\n    'http' => [\n        'user_agent' => 'Mozilla/5.0 ...',\n        // follow_location defaults to true\n        // max_redirects defaults to 20\n    ],\n];\n```\n\nPHP's HTTP stream wrapper follows redirects automatically (up to 20 hops by default). The redirect target URL is **not** re-validated against the domain whitelist. An attacker who can trigger a 302 redirect from a whitelisted domain can redirec","public_affected_ranges":["ECOSYSTEM: introduced 4.0.0; fixed 5.8.1"]},{"certainty":"source_listed","source_ids":["sr-b14ed58cd658b2d7cfb1941f0879330d"],"technology":"phpoffice/phpspreadsheet","known_exclusions":[],"conditions_summary":"### Summary\n\nThe domain whitelist introduced in PhpSpreadsheet 5.4.0 for the `WEBSERVICE()` formula function can be bypassed via HTTP redirect. The whitelist validates only the initial URL's hostname, but `file_get_contents()` follows 302/301 redirects by default without re-validating the redirect target against the whitelist. This allows an attacker to reach internal services through a whitelisted domain that issues an HTTP redirect.\n\n### Details\n\nIn `Calculation/Web/Service.php`, the `webService()` method validates the URL's host against a domain whitelist set via `Spreadsheet::setDomainWhiteList()`. If the host passes validation, the method calls `file_get_contents($url, false, $ctx)` to fetch the content.\n\nThe stream context does not disable redirect following:\n\n```php\n$ctxArray = [\n    'http' => [\n        'user_agent' => 'Mozilla/5.0 ...',\n        // follow_location defaults to true\n        // max_redirects defaults to 20\n    ],\n];\n```\n\nPHP's HTTP stream wrapper follows redirects automatically (up to 20 hops by default). The redirect target URL is **not** re-validated against the domain whitelist. An attacker who can trigger a 302 redirect from a whitelisted domain can redirec","public_affected_ranges":["ECOSYSTEM: introduced 3.3.0; fixed 3.10.7"]},{"certainty":"source_listed","source_ids":["sr-b14ed58cd658b2d7cfb1941f0879330d"],"technology":"phpoffice/phpspreadsheet","known_exclusions":[],"conditions_summary":"### Summary\n\nThe domain whitelist introduced in PhpSpreadsheet 5.4.0 for the `WEBSERVICE()` formula function can be bypassed via HTTP redirect. The whitelist validates only the initial URL's hostname, but `file_get_contents()` follows 302/301 redirects by default without re-validating the redirect target against the whitelist. This allows an attacker to reach internal services through a whitelisted domain that issues an HTTP redirect.\n\n### Details\n\nIn `Calculation/Web/Service.php`, the `webService()` method validates the URL's host against a domain whitelist set via `Spreadsheet::setDomainWhiteList()`. If the host passes validation, the method calls `file_get_contents($url, false, $ctx)` to fetch the content.\n\nThe stream context does not disable redirect following:\n\n```php\n$ctxArray = [\n    'http' => [\n        'user_agent' => 'Mozilla/5.0 ...',\n        // follow_location defaults to true\n        // max_redirects defaults to 20\n    ],\n];\n```\n\nPHP's HTTP stream wrapper follows redirects automatically (up to 20 hops by default). The redirect target URL is **not** re-validated against the domain whitelist. An attacker who can trigger a 302 redirect from a whitelisted domain can redirec","public_affected_ranges":["ECOSYSTEM: introduced 2.2.0; fixed 2.4.7"]},{"certainty":"source_listed","source_ids":["sr-b14ed58cd658b2d7cfb1941f0879330d"],"technology":"phpoffice/phpspreadsheet","known_exclusions":[],"conditions_summary":"### Summary\n\nThe domain whitelist introduced in PhpSpreadsheet 5.4.0 for the `WEBSERVICE()` formula function can be bypassed via HTTP redirect. The whitelist validates only the initial URL's hostname, but `file_get_contents()` follows 302/301 redirects by default without re-validating the redirect target against the whitelist. This allows an attacker to reach internal services through a whitelisted domain that issues an HTTP redirect.\n\n### Details\n\nIn `Calculation/Web/Service.php`, the `webService()` method validates the URL's host against a domain whitelist set via `Spreadsheet::setDomainWhiteList()`. If the host passes validation, the method calls `file_get_contents($url, false, $ctx)` to fetch the content.\n\nThe stream context does not disable redirect following:\n\n```php\n$ctxArray = [\n    'http' => [\n        'user_agent' => 'Mozilla/5.0 ...',\n        // follow_location defaults to true\n        // max_redirects defaults to 20\n    ],\n];\n```\n\nPHP's HTTP stream wrapper follows redirects automatically (up to 20 hops by default). The redirect target URL is **not** re-validated against the domain whitelist. An attacker who can trigger a 302 redirect from a whitelisted domain can redirec","public_affected_ranges":["ECOSYSTEM: introduced 2.0.0; fixed 2.1.18"]},{"certainty":"source_listed","source_ids":["sr-b14ed58cd658b2d7cfb1941f0879330d"],"technology":"phpoffice/phpspreadsheet","known_exclusions":[],"conditions_summary":"### Summary\n\nThe domain whitelist introduced in PhpSpreadsheet 5.4.0 for the `WEBSERVICE()` formula function can be bypassed via HTTP redirect. The whitelist validates only the initial URL's hostname, but `file_get_contents()` follows 302/301 redirects by default without re-validating the redirect target against the whitelist. This allows an attacker to reach internal services through a whitelisted domain that issues an HTTP redirect.\n\n### Details\n\nIn `Calculation/Web/Service.php`, the `webService()` method validates the URL's host against a domain whitelist set via `Spreadsheet::setDomainWhiteList()`. If the host passes validation, the method calls `file_get_contents($url, false, $ctx)` to fetch the content.\n\nThe stream context does not disable redirect following:\n\n```php\n$ctxArray = [\n    'http' => [\n        'user_agent' => 'Mozilla/5.0 ...',\n        // follow_location defaults to true\n        // max_redirects defaults to 20\n    ],\n];\n```\n\nPHP's HTTP stream wrapper follows redirects automatically (up to 20 hops by default). The redirect target URL is **not** re-validated against the domain whitelist. An attacker who can trigger a 302 redirect from a whitelisted domain can redirec","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 1.30.6"]}],"null_published_at":"2026-11-01T14:34:07.479Z","source_updated_at":"2026-07-23T15:11:51.323Z","source_disclosed_at":"2026-07-23T14:55:48.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T21:41:59.936Z"},{"id":"NVI-00006357","kind":"vulnerability","title":"PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-6hq5-7373-42rg","CVE-2026-59931"],"plain_summary":"OSV carries this publisher advisory for phpoffice/phpspreadsheet, phpoffice/phpspreadsheet, phpoffice/phpspreadsheet, phpoffice/phpspreadsheet, phpoffice/phpspreadsheet. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 5.8.1 for phpoffice/phpspreadsheet. Confirm the publisher’s latest guidance.","source_ids":["sr-b14ed58cd658b2d7cfb1941f0879330d"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 3.10.7 for phpoffice/phpspreadsheet. Confirm the publisher’s latest guidance.","source_ids":["sr-b14ed58cd658b2d7cfb1941f0879330d"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 2.4.7 for phpoffice/phpspreadsheet. Confirm the publisher’s latest guidance.","source_ids":["sr-b14ed58cd658b2d7cfb1941f0879330d"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 2.1.18 for phpoffice/phpspreadsheet. Confirm the publisher’s latest guidance.","source_ids":["sr-b14ed58cd658b2d7cfb1941f0879330d"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 1.30.6 for phpoffice/phpspreadsheet. Confirm the publisher’s latest guidance.","source_ids":["sr-b14ed58cd658b2d7cfb1941f0879330d"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-4da7c3357cad0e95586b58f345a90ff2"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.474%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.40977. Missing scores are unknown.","source_id":"sr-4da7c3357cad0e95586b58f345a90ff2"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-b14ed58cd658b2d7cfb1941f0879330d","url":"https://github.com/advisories/GHSA-6hq5-7373-42rg","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-6hq5-7373-42rg","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:59.936Z"},{"id":"sr-4da7c3357cad0e95586b58f345a90ff2","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-59931","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:15.383Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-b14ed58cd658b2d7cfb1941f0879330d"],"technology":"phpoffice/phpspreadsheet","known_exclusions":[],"conditions_summary":"### Summary\n\nThe domain whitelist introduced in PhpSpreadsheet 5.4.0 for the `WEBSERVICE()` formula function can be bypassed via HTTP redirect. The whitelist validates only the initial URL's hostname, but `file_get_contents()` follows 302/301 redirects by default without re-validating the redirect target against the whitelist. This allows an attacker to reach internal services through a whitelisted domain that issues an HTTP redirect.\n\n### Details\n\nIn `Calculation/Web/Service.php`, the `webService()` method validates the URL's host against a domain whitelist set via `Spreadsheet::setDomainWhiteList()`. If the host passes validation, the method calls `file_get_contents($url, false, $ctx)` to fetch the content.\n\nThe stream context does not disable redirect following:\n\n```php\n$ctxArray = [\n    'http' => [\n        'user_agent' => 'Mozilla/5.0 ...',\n        // follow_location defaults to true\n        // max_redirects defaults to 20\n    ],\n];\n```\n\nPHP's HTTP stream wrapper follows redirects automatically (up to 20 hops by default). The redirect target URL is **not** re-validated against the domain whitelist. An attacker who can trigger a 302 redirect from a whitelisted domain can redirec","public_affected_ranges":["ECOSYSTEM: introduced 4.0.0; fixed 5.8.1"]},{"certainty":"source_listed","source_ids":["sr-b14ed58cd658b2d7cfb1941f0879330d"],"technology":"phpoffice/phpspreadsheet","known_exclusions":[],"conditions_summary":"### Summary\n\nThe domain whitelist introduced in PhpSpreadsheet 5.4.0 for the `WEBSERVICE()` formula function can be bypassed via HTTP redirect. The whitelist validates only the initial URL's hostname, but `file_get_contents()` follows 302/301 redirects by default without re-validating the redirect target against the whitelist. This allows an attacker to reach internal services through a whitelisted domain that issues an HTTP redirect.\n\n### Details\n\nIn `Calculation/Web/Service.php`, the `webService()` method validates the URL's host against a domain whitelist set via `Spreadsheet::setDomainWhiteList()`. If the host passes validation, the method calls `file_get_contents($url, false, $ctx)` to fetch the content.\n\nThe stream context does not disable redirect following:\n\n```php\n$ctxArray = [\n    'http' => [\n        'user_agent' => 'Mozilla/5.0 ...',\n        // follow_location defaults to true\n        // max_redirects defaults to 20\n    ],\n];\n```\n\nPHP's HTTP stream wrapper follows redirects automatically (up to 20 hops by default). The redirect target URL is **not** re-validated against the domain whitelist. An attacker who can trigger a 302 redirect from a whitelisted domain can redirec","public_affected_ranges":["ECOSYSTEM: introduced 3.3.0; fixed 3.10.7"]},{"certainty":"source_listed","source_ids":["sr-b14ed58cd658b2d7cfb1941f0879330d"],"technology":"phpoffice/phpspreadsheet","known_exclusions":[],"conditions_summary":"### Summary\n\nThe domain whitelist introduced in PhpSpreadsheet 5.4.0 for the `WEBSERVICE()` formula function can be bypassed via HTTP redirect. The whitelist validates only the initial URL's hostname, but `file_get_contents()` follows 302/301 redirects by default without re-validating the redirect target against the whitelist. This allows an attacker to reach internal services through a whitelisted domain that issues an HTTP redirect.\n\n### Details\n\nIn `Calculation/Web/Service.php`, the `webService()` method validates the URL's host against a domain whitelist set via `Spreadsheet::setDomainWhiteList()`. If the host passes validation, the method calls `file_get_contents($url, false, $ctx)` to fetch the content.\n\nThe stream context does not disable redirect following:\n\n```php\n$ctxArray = [\n    'http' => [\n        'user_agent' => 'Mozilla/5.0 ...',\n        // follow_location defaults to true\n        // max_redirects defaults to 20\n    ],\n];\n```\n\nPHP's HTTP stream wrapper follows redirects automatically (up to 20 hops by default). The redirect target URL is **not** re-validated against the domain whitelist. An attacker who can trigger a 302 redirect from a whitelisted domain can redirec","public_affected_ranges":["ECOSYSTEM: introduced 2.2.0; fixed 2.4.7"]},{"certainty":"source_listed","source_ids":["sr-b14ed58cd658b2d7cfb1941f0879330d"],"technology":"phpoffice/phpspreadsheet","known_exclusions":[],"conditions_summary":"### Summary\n\nThe domain whitelist introduced in PhpSpreadsheet 5.4.0 for the `WEBSERVICE()` formula function can be bypassed via HTTP redirect. The whitelist validates only the initial URL's hostname, but `file_get_contents()` follows 302/301 redirects by default without re-validating the redirect target against the whitelist. This allows an attacker to reach internal services through a whitelisted domain that issues an HTTP redirect.\n\n### Details\n\nIn `Calculation/Web/Service.php`, the `webService()` method validates the URL's host against a domain whitelist set via `Spreadsheet::setDomainWhiteList()`. If the host passes validation, the method calls `file_get_contents($url, false, $ctx)` to fetch the content.\n\nThe stream context does not disable redirect following:\n\n```php\n$ctxArray = [\n    'http' => [\n        'user_agent' => 'Mozilla/5.0 ...',\n        // follow_location defaults to true\n        // max_redirects defaults to 20\n    ],\n];\n```\n\nPHP's HTTP stream wrapper follows redirects automatically (up to 20 hops by default). The redirect target URL is **not** re-validated against the domain whitelist. An attacker who can trigger a 302 redirect from a whitelisted domain can redirec","public_affected_ranges":["ECOSYSTEM: introduced 2.0.0; fixed 2.1.18"]},{"certainty":"source_listed","source_ids":["sr-b14ed58cd658b2d7cfb1941f0879330d"],"technology":"phpoffice/phpspreadsheet","known_exclusions":[],"conditions_summary":"### Summary\n\nThe domain whitelist introduced in PhpSpreadsheet 5.4.0 for the `WEBSERVICE()` formula function can be bypassed via HTTP redirect. The whitelist validates only the initial URL's hostname, but `file_get_contents()` follows 302/301 redirects by default without re-validating the redirect target against the whitelist. This allows an attacker to reach internal services through a whitelisted domain that issues an HTTP redirect.\n\n### Details\n\nIn `Calculation/Web/Service.php`, the `webService()` method validates the URL's host against a domain whitelist set via `Spreadsheet::setDomainWhiteList()`. If the host passes validation, the method calls `file_get_contents($url, false, $ctx)` to fetch the content.\n\nThe stream context does not disable redirect following:\n\n```php\n$ctxArray = [\n    'http' => [\n        'user_agent' => 'Mozilla/5.0 ...',\n        // follow_location defaults to true\n        // max_redirects defaults to 20\n    ],\n];\n```\n\nPHP's HTTP stream wrapper follows redirects automatically (up to 20 hops by default). The redirect target URL is **not** re-validated against the domain whitelist. An attacker who can trigger a 302 redirect from a whitelisted domain can redirec","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 1.30.6"]}],"null_published_at":"2026-10-31T23:18:17.281Z","source_updated_at":"2026-07-23T15:11:51.323Z","source_disclosed_at":"2026-07-23T14:55:48.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:41:59.936Z"},{"id":"NVI-00006357","kind":"vulnerability","title":"PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-6hq5-7373-42rg","CVE-2026-59931"],"plain_summary":"OSV carries this publisher advisory for phpoffice/phpspreadsheet, phpoffice/phpspreadsheet, phpoffice/phpspreadsheet, phpoffice/phpspreadsheet, phpoffice/phpspreadsheet. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 5.8.1 for phpoffice/phpspreadsheet. Confirm the publisher’s latest guidance.","source_ids":["sr-b14ed58cd658b2d7cfb1941f0879330d"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 3.10.7 for phpoffice/phpspreadsheet. Confirm the publisher’s latest guidance.","source_ids":["sr-b14ed58cd658b2d7cfb1941f0879330d"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 2.4.7 for phpoffice/phpspreadsheet. Confirm the publisher’s latest guidance.","source_ids":["sr-b14ed58cd658b2d7cfb1941f0879330d"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 2.1.18 for phpoffice/phpspreadsheet. Confirm the publisher’s latest guidance.","source_ids":["sr-b14ed58cd658b2d7cfb1941f0879330d"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 1.30.6 for phpoffice/phpspreadsheet. Confirm the publisher’s latest guidance.","source_ids":["sr-b14ed58cd658b2d7cfb1941f0879330d"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-b14ed58cd658b2d7cfb1941f0879330d","url":"https://github.com/advisories/GHSA-6hq5-7373-42rg","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-6hq5-7373-42rg","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:59.936Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-b14ed58cd658b2d7cfb1941f0879330d"],"technology":"phpoffice/phpspreadsheet","known_exclusions":[],"conditions_summary":"### Summary\n\nThe domain whitelist introduced in PhpSpreadsheet 5.4.0 for the `WEBSERVICE()` formula function can be bypassed via HTTP redirect. The whitelist validates only the initial URL's hostname, but `file_get_contents()` follows 302/301 redirects by default without re-validating the redirect target against the whitelist. This allows an attacker to reach internal services through a whitelisted domain that issues an HTTP redirect.\n\n### Details\n\nIn `Calculation/Web/Service.php`, the `webService()` method validates the URL's host against a domain whitelist set via `Spreadsheet::setDomainWhiteList()`. If the host passes validation, the method calls `file_get_contents($url, false, $ctx)` to fetch the content.\n\nThe stream context does not disable redirect following:\n\n```php\n$ctxArray = [\n    'http' => [\n        'user_agent' => 'Mozilla/5.0 ...',\n        // follow_location defaults to true\n        // max_redirects defaults to 20\n    ],\n];\n```\n\nPHP's HTTP stream wrapper follows redirects automatically (up to 20 hops by default). The redirect target URL is **not** re-validated against the domain whitelist. An attacker who can trigger a 302 redirect from a whitelisted domain can redirec","public_affected_ranges":["ECOSYSTEM: introduced 4.0.0; fixed 5.8.1"]},{"certainty":"source_listed","source_ids":["sr-b14ed58cd658b2d7cfb1941f0879330d"],"technology":"phpoffice/phpspreadsheet","known_exclusions":[],"conditions_summary":"### Summary\n\nThe domain whitelist introduced in PhpSpreadsheet 5.4.0 for the `WEBSERVICE()` formula function can be bypassed via HTTP redirect. The whitelist validates only the initial URL's hostname, but `file_get_contents()` follows 302/301 redirects by default without re-validating the redirect target against the whitelist. This allows an attacker to reach internal services through a whitelisted domain that issues an HTTP redirect.\n\n### Details\n\nIn `Calculation/Web/Service.php`, the `webService()` method validates the URL's host against a domain whitelist set via `Spreadsheet::setDomainWhiteList()`. If the host passes validation, the method calls `file_get_contents($url, false, $ctx)` to fetch the content.\n\nThe stream context does not disable redirect following:\n\n```php\n$ctxArray = [\n    'http' => [\n        'user_agent' => 'Mozilla/5.0 ...',\n        // follow_location defaults to true\n        // max_redirects defaults to 20\n    ],\n];\n```\n\nPHP's HTTP stream wrapper follows redirects automatically (up to 20 hops by default). The redirect target URL is **not** re-validated against the domain whitelist. An attacker who can trigger a 302 redirect from a whitelisted domain can redirec","public_affected_ranges":["ECOSYSTEM: introduced 3.3.0; fixed 3.10.7"]},{"certainty":"source_listed","source_ids":["sr-b14ed58cd658b2d7cfb1941f0879330d"],"technology":"phpoffice/phpspreadsheet","known_exclusions":[],"conditions_summary":"### Summary\n\nThe domain whitelist introduced in PhpSpreadsheet 5.4.0 for the `WEBSERVICE()` formula function can be bypassed via HTTP redirect. The whitelist validates only the initial URL's hostname, but `file_get_contents()` follows 302/301 redirects by default without re-validating the redirect target against the whitelist. This allows an attacker to reach internal services through a whitelisted domain that issues an HTTP redirect.\n\n### Details\n\nIn `Calculation/Web/Service.php`, the `webService()` method validates the URL's host against a domain whitelist set via `Spreadsheet::setDomainWhiteList()`. If the host passes validation, the method calls `file_get_contents($url, false, $ctx)` to fetch the content.\n\nThe stream context does not disable redirect following:\n\n```php\n$ctxArray = [\n    'http' => [\n        'user_agent' => 'Mozilla/5.0 ...',\n        // follow_location defaults to true\n        // max_redirects defaults to 20\n    ],\n];\n```\n\nPHP's HTTP stream wrapper follows redirects automatically (up to 20 hops by default). The redirect target URL is **not** re-validated against the domain whitelist. An attacker who can trigger a 302 redirect from a whitelisted domain can redirec","public_affected_ranges":["ECOSYSTEM: introduced 2.2.0; fixed 2.4.7"]},{"certainty":"source_listed","source_ids":["sr-b14ed58cd658b2d7cfb1941f0879330d"],"technology":"phpoffice/phpspreadsheet","known_exclusions":[],"conditions_summary":"### Summary\n\nThe domain whitelist introduced in PhpSpreadsheet 5.4.0 for the `WEBSERVICE()` formula function can be bypassed via HTTP redirect. The whitelist validates only the initial URL's hostname, but `file_get_contents()` follows 302/301 redirects by default without re-validating the redirect target against the whitelist. This allows an attacker to reach internal services through a whitelisted domain that issues an HTTP redirect.\n\n### Details\n\nIn `Calculation/Web/Service.php`, the `webService()` method validates the URL's host against a domain whitelist set via `Spreadsheet::setDomainWhiteList()`. If the host passes validation, the method calls `file_get_contents($url, false, $ctx)` to fetch the content.\n\nThe stream context does not disable redirect following:\n\n```php\n$ctxArray = [\n    'http' => [\n        'user_agent' => 'Mozilla/5.0 ...',\n        // follow_location defaults to true\n        // max_redirects defaults to 20\n    ],\n];\n```\n\nPHP's HTTP stream wrapper follows redirects automatically (up to 20 hops by default). The redirect target URL is **not** re-validated against the domain whitelist. An attacker who can trigger a 302 redirect from a whitelisted domain can redirec","public_affected_ranges":["ECOSYSTEM: introduced 2.0.0; fixed 2.1.18"]},{"certainty":"source_listed","source_ids":["sr-b14ed58cd658b2d7cfb1941f0879330d"],"technology":"phpoffice/phpspreadsheet","known_exclusions":[],"conditions_summary":"### Summary\n\nThe domain whitelist introduced in PhpSpreadsheet 5.4.0 for the `WEBSERVICE()` formula function can be bypassed via HTTP redirect. The whitelist validates only the initial URL's hostname, but `file_get_contents()` follows 302/301 redirects by default without re-validating the redirect target against the whitelist. This allows an attacker to reach internal services through a whitelisted domain that issues an HTTP redirect.\n\n### Details\n\nIn `Calculation/Web/Service.php`, the `webService()` method validates the URL's host against a domain whitelist set via `Spreadsheet::setDomainWhiteList()`. If the host passes validation, the method calls `file_get_contents($url, false, $ctx)` to fetch the content.\n\nThe stream context does not disable redirect following:\n\n```php\n$ctxArray = [\n    'http' => [\n        'user_agent' => 'Mozilla/5.0 ...',\n        // follow_location defaults to true\n        // max_redirects defaults to 20\n    ],\n];\n```\n\nPHP's HTTP stream wrapper follows redirects automatically (up to 20 hops by default). The redirect target URL is **not** re-validated against the domain whitelist. An attacker who can trigger a 302 redirect from a whitelisted domain can redirec","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 1.30.6"]}],"null_published_at":"2026-10-31T22:13:10.053Z","source_updated_at":"2026-07-23T15:11:51.323Z","source_disclosed_at":"2026-07-23T14:55:48.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:41:59.936Z"}],"next_cursor":null,"snapshot_revision":"42594"}