CVE-2026-111418 in PDF
Summary
by MITRE • 10/29/2026
A server-side request forgery (SSRF) vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service. Support for ZIP-formatted input can bypass restrictions on requests to internal IP addresses, potentially allowing discovery of internal network resources.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The identified security flaw resides within the server-side processing logic of the HTML-to-PDF conversion utility hosted by Foxit's official web portal. This vulnerability is classified as a Server-Side Request Forgery (SSRF), specifically leveraging an input validation bypass mechanism related to archive file handling. The core technical issue stems from how the application processes ZIP-formatted inputs submitted for conversion. When a user provides a ZIP archive containing HTML files, the server extracts these contents and subsequently initiates HTTP requests to resolve any relative or absolute URLs embedded within those HTML documents. Crucially, the internal security controls designed to prevent SSRF attacks fail to adequately sanitize or restrict the destination addresses of these generated outbound requests when they originate from within an extracted archive context.
The operational mechanism allows an attacker to craft a malicious ZIP file containing HTML content with links pointing to private IP address ranges, such as 10.x.x.x, 172.16.x.x through 172.31.x.x, or 192.168.x.x, which are typically reserved for internal network infrastructure and inaccessible from the public internet. By submitting this crafted archive to the conversion service, the server-side component extracts the HTML and attempts to fetch resources referenced within it. Because the SSRF mitigation logic does not properly validate these URLs against a deny list of private address spaces in this specific execution path, the server successfully connects to internal services. This behavior effectively turns the vulnerable application into a proxy that can be used to probe the internal network topology from an external position.
The impact of this vulnerability is significant as it facilitates unauthorized discovery and potential exploitation of internal network resources. An attacker could use this SSRF vector to scan for open ports, identify running services such as databases, administrative panels, or legacy applications that are not exposed publicly, and potentially interact with them if those services lack additional authentication controls. This capability undermines the principle of network segmentation by allowing an external actor to reach assets that should remain isolated behind firewalls or internal routing rules. In severe cases, this could lead further into lateral movement within the organization's infrastructure, depending on the sensitivity and exposure level of the discovered internal endpoints.
From a classification perspective, this vulnerability aligns with CWE-918, which describes Server-Side Request Forgery (SSRF) flaws where the web server makes requests to URLs provided by users without sufficient validation. It also maps to MITRE ATT&CK technique T1571, specifically the Proxy component, as the attacker utilizes a legitimate service to relay traffic into internal networks. The specific bypass mechanism involving archive formats highlights CWE-20, Improper Input Validation, where the application fails to enforce consistent security policies across different input processing paths.
To mitigate this risk, immediate remediation should focus on implementing strict URL validation for all outbound requests initiated by the server, regardless of whether they originate from direct user input or extracted file contents. This includes enforcing a deny list that blocks access to private IP ranges and loopback addresses at the network layer or application firewall level. Additionally, developers must ensure that SSRF protections are applied uniformly across all code paths involving resource fetching, including those triggered by archive extraction processes. Implementing allow-lists for permitted domains is also recommended over relying solely on deny lists, as this approach provides a more robust defense against evolving bypass techniques. Regular security testing and penetration testing should be conducted to verify that such input validation controls remain effective across all service endpoints.