Detections
Analytics

SCA: security update for phpoffice/phpspreadsheet (GHSA-2phh-27fw-q4gc)

medium Tenable Cloud Security Plugin ID 477593

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19,
 2.4.8, 3.10.8, and 5.10.0, Worksheet\Drawing::setPath validates only the initial external-image URL with
 setIsWhitelisted when setAllowExternalImages is enabled. The HTTP stream context permits PHP to follow a
 redirect without applying the callback to the redirected URL, so a permitted image host can redirect the
 server to an internal address and cause a blind GET request. The response body is not returned to the
 attacker because the reader validates the downloaded content as an image and removes the temporary file,
 but internal GET-driven endpoints, network reachability, and cloud metadata endpoints may be reached. This
 issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0. (CVE-2026-108360)

Solution

Update the phpoffice/phpspreadsheet library and its related packages to version 1.30.7 or later.

See Also

https://github.com/advisories/GHSA-2phh-27fw-q4gc

Plugin Details

Severity: Medium

ID: 477593

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/27/2026

Updated: 10/27/2026

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 10.29

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.1

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS Score Source: CVE-2026-108360

CVSS v3

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 5.6

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/27/2026

Vulnerability Publication Date: 10/22/2026

Reference Information

CVE: CVE-2026-108360