CVE-2026-59931

설명

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE() domain whitelist can be bypassed via an HTTP redirect (SSRF). In Calculation/Web/Service.php, the webService() method validates a URL's host against the whitelist set via Spreadsheet::setDomainWhiteList(), then fetches content with file_get_contents($url, false, $ctx); because PHP's HTTP stream wrapper follows 301/302 redirects automatically (up to 20 hop...

영향 제품·버전

제품 PHPOffice PhpSpreadsheet

영향 버전 PHPOffice PhpSpreadsheet >= >= 4.0.0, < 5.8.1, >= >= 3.3.0, < 3.10.7, >= >= 2.2.0, < 2.4.7, >= >= 2.0.0, < 2.1.18, >= < 1.30.6

수정 버전 PHPOffice PhpSpreadsheet · 수정 버전은 공급사 공식자료 확인 필요

기술 정보

CVSS 벡터 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CWE CWE-918