PhpSpreadsheet allows a Server Side Request Forgery (SSRF) when the WEBSERVICE() function is used with a URL that belongs to a whitelisted domain but then redirects with an HTTP 301/302 response. PHP’s HTTP stream wrapper follows up to twenty redirects automatically, without re‑validating the destination host, giving an attacker the ability to fetch data from arbitrary internal or external addresses. If an attacker is able to supply or upload a spreadsheet containing such a formula, they can read up to 32,767 bytes of the response, enabling exfiltration of cloud service metadata, scanning of internal services, and access to back‑end endpoints. The vulnerability does not elevate the PHP process privileges; it simply offers network reachability and data exfiltration that can facilitate further attacks.

The library affected is PhpSpreadsheet from PHPOffice. All releases up to and including 1.30.5, 2.0.0 through 2.1.17, 2.2.0 through 2.4.6, 3.3.0 through 3.10.6, and 4.0.0 through 5.8.0 are vulnerable. Fixed releases begin at 1.30.6, 2.1.18, 2.4.7, 3.10.7, and 5.8.1.

The CVSS score of 7.7 indicates a high impact with moderate exploitation complexity. The EPSS score is below 1 %, suggesting a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. An attacker who can provide a spreadsheet that triggers the WEBSERVICE function can reach arbitrary URLs, including internal services, and exfiltrate up to 32,767 bytes of response data. Exploitation requires only the ability to operate in an environment where the application processes untrusted spreadsheets.