CVE-2026-108360

The PhpSpreadsheet PHP library is vulnerable to Server-Side Request Forgery (SSRF) in versions prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0. The root cause is that Worksheet oc.Drawing::setPath only validates the initial external-image URL against a whitelist when setAllowExternalImages is ...

CVE-2026-108360 PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Worksheet\Drawing::setPath validates only the initial external-image URL with setIsWhitelisted when setAllowExternalImages is enabled. The HTTP stream context permit...

Linux Distros Unpatched Vulnerability : CVE-2023-38059

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The loading of external images is not blocked, even if configured, if the attacker uses protocol-relative URL in the payload. This can be used to retreive the I...

CVE-2024-23330 Tuta loads images from external resources

Tuta is an encrypted email service. In versions prior to 119.10, an attacker can attach an image in a html mail which is loaded from external resource in the default setting, which should prevent loading of external resources. When displaying emails containing external content, they should be...

OTRS Security Vulnerabilities

OTRS is an application from OTRS Germany. A service management software. A security vulnerability exists in OTRS prior to 7.0.47, versions prior to 8.0.37, and OTRS Community Edition versions 6.0.X through 6.0.34, which stems from a vulnerability that does not prevent an external IMAGE from being...

openSUSE Security Update : otrs (openSUSE-2019-748)

This update for otrs to version 4.0.32 fixes the following issues : These security issues were fixed : - CVE-2018-16586: An attacker could have sent a malicious email to an OTRS system. If a logged in user opens it, the email could have caused the browser to load external image or CSS resources...

Denial Of Service (DoS)

svgexport is vulnerable to denial of service. A lack of timeout when loading an external image can result in a denial of service condition...