[ CVE-2026-111418 · Published 29 Oct 2026 ]
Vulnerability in Foxit Software Inc. foxit.com
CVSS 7.5
EPSS <1%1 agency advisoryFix available
[ Description ]Official description
A server-side request forgery (SSRF) vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service. Support for ZIP-formatted input can bypass restrictions on requests to internal IP addresses, potentially allowing discovery of internal network resources.
[ Fixes ]Fixes and patches
- Security bulletin: FoxIT security-bulletins.phpVendor patch or bulletin · CERT-FR · foxitsoftware.com/support/security-bulletins.php, cited by CERT-FR CERTFR-2026-AVI-1418
[ Advisories ]Government CERT advisories
-
CERT-FRCERTFR-2026-AVI-1418
Multiple vulnerabilities in Foxit Online Services Translated from French
Multiple vulnerabilities have been discovered in Foxit Online Services. Some of them allow an attacker to cause a breach of data confidentiality, a breach of data integrity and server-side request forgery (SSRF).