CVE-2026-111418
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A server-side request forgery (SSRF) vulnerability exists in the Foxit official website's HTML-to-PDF conversion service. Support for ZIP-formatted input can bypass restrictions on requests to internal IP addresses, potentially allowing discovery of internal network resources.
Risk Assessment
An attacker could exploit the SSRF to scan and access internal network resources. This may lead to disclosure of internal infrastructure information.
Recommendation
Restrict requests to internal IP addresses and review ZIP archive handling in the conversion service. Implement server-side URL validation and filtering.
Other vulnerabilities in Foxit official website
See all- CVE-2026-111419High
A sensitive information exposure vulnerability exists on the Foxit official website because JavaScript code contains third-party authorization information. This may allow unauthorized parties to obtain or misuse the exposed credentials.
- CVE-2026-111417High
A broken access control vulnerability exists in the Foxit official website's HTML-to-PDF conversion service due to the use of a shared token for submitted conversion documents. This may allow unauthorized users to access documents submitted by other users.
Original NVD description (English source)
A server-side request forgery (SSRF) vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service. Support for ZIP-formatted input can bypass restrictions on requests to internal IP addresses, potentially allowing discovery of internal network resources.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS