PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading

Summary PhpSpreadsheet's Worksheet\Drawing::setPath() validates an external-image URL against an operator-supplied isWhitelisted callback once, on the initial URL only, then fetches it with filegetcontents() using a stream context that does not set followlocation => 0. A whitelisted host that returns an HTTP 302 Location: redirect to an internal target is therefore followed by PHP's HTTP wrapper (default followlocation=1, maxredirects=20) with no re-validation of the redirect hop — defeating the whitelist and yielding a blind SSRF from the server. This is an unfixed variant of CVE-2026-59931 (GHSA-6hq5-7373-42rg, the WEBSERVICE redirect-whitelist-bypass): the followlocation => 0 fix (commit 7ef7b25e) was applied ONLY to Calculation/Web/Service.php; Worksheet/Drawing.php was never touched. Root Cause src/PhpSpreadsheet/Worksheet/Drawing.php: Scheme allowlist at :125 (/^(http|https|file|ftp|s3):/) permits http/https (the redirect-following schemes) and runs on the initial URL only. Opt-in gate if (!$allowExternal) at :128 (requires setAllowExternalImages(true); default false, BaseReader.php:55). Whitelist check if ($isWhitelisted !== null && !$isWhitelisted($path)) at :131 —…

curl https://cve.zerocrew.in/api/cve/CVE-2026-108360