The vulnerability resides in PhpSpreadsheet’s Drawing::setPath method, which validates only the original image URL when external images are allowed. A crafted URL can redirect to an internal host; the PHP stream context follows the redirect without reapplying the whitelist, resulting in a blind GET request to the internal address. While the returned content is discarded, the request can still invoke internal services, accessible network resources, or cloud metadata endpoints, enabling an attacker to discover or interact with internal infrastructure.

PHPOffice’s PhpSpreadsheet library, versions prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, is affected. Any project that uses these older releases and processes spreadsheets containing external image references is potentially vulnerable.

The CVSS score for this issue is 6.4, indicating moderate severity. No EPSS score is published and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed or widespread exploitation yet. The likelihood of exploitation remains modest; an attacker would need to supply a malicious spreadsheet that the application processes, but once the file is executed the SSRF can be triggered with a single redirect. The impact is confined to internal network connectivity and discovery rather than immediate code execution or data exfiltration, yet it can be leveraged to access sensitive internal endpoints and cloud metadata which could serve further attack stages.