The vulnerability is a server‑side request forgery located in Coupa’s Supplier Portal SaaS, specifically within the document conversion feature used for contract templates. An authenticated attacker with the ability to modify templates can craft a DOCX file that contains references to remote or internal resources. The Aspose.Words Java library then processes these references and accesses the specified URLs, files, or internal services. If the attacker controls the endpoint, the server can retrieve confidential data, such as configuration files, system files, credentials, environment variables, and internal service endpoints. This leads to potential data disclosure.

Applications affected are the Coupa Total Spend Management Platform, part of the Coupa Supplier Portal SaaS. No specific patched or unpatched versions are referenced in the advisory; therefore, all instances that expose the vulnerable document‑conversion functionality should be considered at risk until a vendor patch is released.

The CVSS score of 8.4 classifies the flaw as high severity. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog, so there is currently no publicly documented exploitation effort. Nonetheless, exploitation requires only an authenticated user with template‑edit privileges, a common role in many organizations. Because the attack would allow an attacker to read arbitrary internal files or remote resources, the risk to confidentiality is high. Organizations should assume the vulnerability is exploitable until a patch or mitigation is applied.