CVE-2026-111036 in Total Spend Management Platform
Summary
by MITRE • 11/04/2026
Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functionality available in the ‘Contracts > Templates’ section. The vulnerability is due to insufficient validation of references to external resources processed by the Aspose.Words for Java library during DOCX-to-PDF conversion. An authenticated attacker with permissions to modify templates could upload a specially crafted DOCX document containing references to external resources, which would cause the server-side application to access URLs controlled by the attacker, resources on the internal network, or local files. A successful exploit could lead to the disclosure of sensitive information, such as configuration files, system files, credentials, environment variables and endpoints for internal services.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The Coupa Supplier Portal SaaS platform contains a critical server-side request forgery vulnerability within its document conversion functionality, specifically located in the Contracts Templates section where DOCX to PDF conversions are processed. This security flaw stems from insufficient validation of external resource references handled by the Aspose.Words for Java library during the rendering process. When an authenticated user with permissions to modify templates uploads a specially crafted Microsoft Word document containing maliciously constructed links or embedded objects, the server-side application blindly processes these references without verifying their legitimacy or origin. This lack of input sanitization allows the underlying conversion engine to initiate network requests directed by the attacker rather than solely relying on local resources, effectively turning the document processing service into an open proxy for arbitrary HTTP requests initiated from the backend infrastructure.
The operational impact of this vulnerability is severe due to its potential for internal network reconnaissance and data exfiltration. An authenticated attacker can leverage this flaw to force the Coupa server to access URLs controlled by the adversary, probe resources on the internal corporate network that are not exposed to the public internet, or read local files from the application server's filesystem. Successful exploitation enables the disclosure of sensitive information including configuration files containing database credentials and API keys, system-level environment variables, and endpoints for other internal services such as authentication servers or microservices APIs. This capability effectively bypasses perimeter security controls since the requests originate from a trusted internal IP address, allowing attackers to map out the broader infrastructure and potentially pivot to more critical systems within the organization's network segment.
From a classification perspective, this vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF), which describes flaws where a web application fetches a remote resource without validating the user-supplied URL. Furthermore, in terms of tactical mapping under the MITRE ATT&CK framework, this exploit corresponds to T1560.002 Archive Collected Data via Utility and potentially T1078 Valid Accounts if the attacker leverages compromised credentials or legitimate high-privilege accounts within the Coupa platform. The vulnerability highlights a common risk in enterprise SaaS applications that utilize third-party libraries for document processing, where complex file formats like DOCX can contain embedded hyperlinks or external object references that are processed by the rendering engine during conversion to static formats like PDF.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. Coupa should apply vendor-provided patches that update the Aspose.Words for Java library to a version with stricter URL validation policies, ensuring that only whitelisted domains or local file paths are permitted during conversion operations. For organizations currently using the platform, it is advisable to restrict outbound network traffic from the document processing servers via firewall rules and egress filtering to prevent access to unauthorized internal subnets and external attacker-controlled endpoints. Additionally, implementing a web application firewall with SSRF detection capabilities can provide an additional layer of defense by inspecting outgoing requests for suspicious patterns or known malicious IP addresses. Users should also adhere to the principle of least privilege by ensuring that template modification permissions are granted only to essential personnel, thereby reducing the attack surface available to potential adversaries seeking to exploit this functionality.