GHSA-2PHH-27FW-Q4GC PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading

Summary PhpSpreadsheet's Worksheet\Drawing::setPath validates an external-image URL against an operator-supplied isWhitelisted callback once, on the initial URL only, then fetches it with filegetcontents using a stream context that does not set followlocation = 0. A whitelisted host that returns ...