CVE-2026-108360 | PHPOffice PhpSpreadsheet up to 5.9.x Image URL Validation setPath server-side request forgery

October 22, 2026 Yanac

A vulnerability was found in PHPOffice PhpSpreadsheet up to 1.30.6/2.1.18/2.4.7/3.10.7/5.9.x. It has been classified as problematic. This affects the function WorksheetDrawing::setPath of the component Image URL Validation. The manipulation leads to server-side request forgery.

This vulnerability is traded as CVE-2026-108360. It is possible to initiate the attack remotely. There is no exploit available.

Upgrading the affected component is recommended.VulDB Recent EntriesRead More