CVE-2026-119433: Server-Side Request Forgery in Foxit Workspace PDF Export

Published Nov 6, 2026

Updated

A server-side request forgery (SSRF) vulnerability exists in an undocumented API endpoint of Foxit Workspace due to insufficient validation of user-supplied URL and network parameters. A remote attacker could exploit this issue to induce the server to send requests to arbitrary internal or external resources, potentially enabling unauthorized access to internal services, network reconnaissance, and sensitive information disclosure.

Event History

Nov 6, 2026

CVE Published

via MITRE·04:09 AM

Data Sourced

via MITRE·04:09 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of attacker access is indicated for exploitation?

The issue is described as remotely exploitable. The available information does not state whether authentication or any specific user role is required.

Is a fixed version or vendor mitigation provided?

No fixed version, patch information, or workaround is included in the supplied data. The listed reference is Foxit’s security bulletins page.

Are default deployments known to be affected?

The available information does not say whether the undocumented API endpoint is enabled or reachable in default configurations.

CVE-2026-119433: Server-Side Request Forgery in Foxit Workspace PDF Export

Event History

Frequently Asked Questions

What level of attacker access is indicated for exploitation?

Is a fixed version or vendor mitigation provided?

Are default deployments known to be affected?

Company

Resources

Contact

Frequently Asked Questions

What level of attacker access is indicated for exploitation?

Is a fixed version or vendor mitigation provided?

Are default deployments known to be affected?