CVE-2026-111036: Multiple vulnerabilities in Coupa’s Total Spend Management Platform
Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functionality available in the ‘Contracts > Templates’ section. The vulnerability is due to insufficient validation of references to external resources processed by the Aspose.Words for Java library during DOCX-to-PDF conversion. An authenticated attacker with permissions to modify templates could upload a specially crafted DOCX document containing references to external resources, which would cause the server-side application to access URLs controlled by the attacker, resources on the internal network, or local files. A successful exploit could lead to the disclosure of sensitive information, such as configuration files, system files, credentials, environment variables and endpoints for internal services.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to the Coupa Supplier Portal and have permission to modify templates in Contracts > Templates. The issue is therefore relevant to organizations that grant template-editing access to users who should not be able to trigger server-side network or file access.
What does exploitation require?
The attacker needs to upload a specially crafted DOCX template containing references to external resources and cause it to be processed by the DOCX-to-PDF conversion functionality. The vulnerable processing occurs through the Aspose.Words for Java library.
What could an attacker access through the vulnerable server?
The server may be induced to access attacker-controlled URLs, internal-network resources, or local files. Disclosed information may include configuration or system files, credentials, environment variables, and internal service endpoints.