A high-severity Server-Side Request Forgery (SSRF) vulnerability (CWE-918) has been disclosed in the popular PHP library PhpSpreadsheet, which is used extensively for reading and writing spreadsheet formats, including HTML.
The flaw allows an attacker to coerce the server into making arbitrary HTTP requests when processing an HTML document containing attacker-controlled <img> tags.
On August 23, 2025, cybersecurity researcher Aleksey Solovev of Positive Technologies published advisory GHSA-rx7m-68vc-ppxh.
The issue arises in the PhpOffice\PhpSpreadsheet\Worksheet\Drawing class’s setPath method: when the HTML reader encounters an <img src=”…”> Reference, it blindly uses the provided URL to fetch the image resource.
By supplying a URL pointing to an internal or protected endpoint—such as http://127.0.0.1:1337—An attacker can induce the server to send unauthorized requests and potentially leak sensitive data or interact with internal services.
Technical Details
- Product: PhpSpreadsheet
- Vulnerable Component:
PhpOffice\PhpSpreadsheet\Worksheet\Drawing::setPath() - Affected Versions:
- Any version earlier than 1.30.0
- Versions ≥2.0.0 and <2.1.12
- Versions ≥2.2.0 and <2.4.0
- Versions ≥3.0.0 and <3.10.0
- Versions ≥4.0.0 and <5.0.0
- Patched Versions: 1.30.0, 2.1.12, 2.4.0, 3.10.0, 5.0.0
When an HTML file is loaded via:
php$reader = \PhpOffice\PhpSpreadsheet\IOFactory::createReader('Html');
$spreadsheet = $reader->load('./doc/file.html');
any <img src="…"> tags in file.html trigger the library to fetch external resources over HTTP(S). If the attacker controls the HTML input, they can direct the server to access internal-only endpoints or ports, resulting in a classic SSRF exploitation.
Impact and Severity
According to Common Vulnerability Scoring System (CVSS) vectors, the flaw scores 7.5 under v3.1 (High) and 8.7 under v4.0 (High), reflecting the ease of exploitation (no privileges required) and the high potential for data exposure.
While the attack does not directly compromise the confidentiality of PhpSpreadsheet data structures, it can disclose internal HTTP resources, enabling the enumeration of cloud metadata services, intranet servers, or administrative interfaces.
Additional Risk: Unsafe Deserialization
Analysis of the same setPath method reveals a secondary concern: the library invokes file_exists() on the provided path, which can be a PHAR archive.
This opens an avenue for unsafe deserialization, allowing crafted PHAR files to execute arbitrary object instantiation when unarchived.
Mitigation
Developers must upgrade to one of the patched versions listed above. For custom implementations, it is crucial to sanitize or validate the $path parameter in setPath(), restricting fetches to permitted domains or disabling external URL fetching entirely.
Implementing allowlists or using safe HTTP clients with strict redirect and IP validation will mitigate SSRF risk.
Affected and Patched Versions
| Affected Version Range | Patched Version |
|---|---|
| < 1.30.0 | 1.30.0 |
| ≥ 2.0.0 and < 2.1.12 | 2.1.12 |
| ≥ 2.2.0 and < 2.4.0 | 2.4.0 |
| ≥ 3.0.0 and < 3.10.0 | 3.10.0 |
| ≥ 4.0.0 and < 5.0.0 | 5.0.0 |
This SSRF vulnerability in PhpSpreadsheet underscores the importance of input validation when handling HTML content and external resources.
All users of the library should promptly update to a secure release and review any code paths that process user-supplied HTML to prevent similar misuse in the future.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates
%20(1).webp?fit=1600,900&ssl=1&description=The flaw allows an attacker to coerce the server into making arbitrary HTTP requests when processing an HTML document containing attacker-controlled tags.){kind=link}