[MEDIUM] PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading

PKSA-r15m-kszr-8n8q CVE-2026-108360 GHSA-2phh-27fw-q4gc

Affected package: phpoffice/phpspreadsheet

Affected version: <=1.30.6|>=2.0.0,<=2.1.18|>=2.2.0,<=2.4.7|>=3.3.0,<=3.10.7|>=4.0.0,<=5.9.0

Reported by:
GitHub