Detections
Analytics

SCA: security update for phpoffice/phpspreadsheet (GHSA-6hq5-7373-42rg)

high Tenable Cloud Security Plugin ID 445213

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through
 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and
 including 1.30.5, the WEBSERVICE() domain whitelist can be bypassed via an HTTP redirect (SSRF). In
 Calculation/Web/Service.php, the webService() method validates a URL's host against the whitelist set via
 Spreadsheet::setDomainWhiteList(), then fetches content with file_get_contents($url, false, $ctx); because
 PHP's HTTP stream wrapper follows 301/302 redirects automatically (up to 20 hops) and the redirect target
 is never re-validated, an attacker who can trigger a redirect from a whitelisted domain can reach
 arbitrary URLs, including internal addresses. An attacker able to upload XLSX files to an application that
 uses setDomainWhiteList() and getCalculatedValue() can achieve a full-read SSRF, returning up to 32,767
 bytes of the response body as a cell's calculated value, which enables exfiltration of cloud metadata
 (AWS/GCP/Azure credentials via http://169.254.169.254/), access to internal-only services, and internal
 port scanning (the port is not validated). This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7,
 2.1.18, and 1.30.6. (CVE-2026-59931)

Solution

Update the phpoffice/phpspreadsheet library and its related packages to version 1.30.6 or later.

See Also

https://github.com/advisories/GHSA-6hq5-7373-42rg

Plugin Details

Severity: High

ID: 445213

Version: Revision 1.3

Type: Local

Family: SCA Checks

Published: 7/23/2026

Updated: 7/29/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5.3

Percentile: 96.25

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N

CVSS Score Source: CVE-2026-59931

CVSS v3

Risk Factor: High

Base Score: 7.7

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/23/2026

Vulnerability Publication Date: 7/23/2026

Reference Information

CVE: CVE-2026-59931

cwe: CWE-918