CVE-2026-111418: SSRF and JavaScript Execution in the Foxit Official Website's HTML-to-PDF Service
Published Oct 29, 2026
·Updated
A server-side request forgery (SSRF) vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service. Support for ZIP-formatted input can bypass restrictions on requests to internal IP addresses, potentially allowing discovery of internal network resources.
Affected Software
1 affected component
Foxit HTML-to-PDF conversion service
Event History
Oct 29, 2026
CVE Published
via MITRE·09:45 AM
Data Sourced
via MITRE·09:45 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require an authenticated account or user interaction?
No. The CVSS vector indicates the issue is network-reachable, has low attack complexity, requires no privileges, and does not require user interaction.
2
What is the assessed security impact beyond internal resource discovery?
The CVSS assessment rates confidentiality impact as high. Integrity and availability impacts are rated as none.