The vulnerability is a server‑side request forgery that can be triggered by submitting a ZIP‑formatted input to the official website’s HTML‑to‑PDF conversion service. The ZIP payload can bypass normal request restrictions and force the server to reach internal IP addresses, allowing an attacker to enumerate private hosts, services, and potentially pivot to further exploitation. The weakness is an instance of insecure input handling (CWE‑918).

Foxit Software Inc. operates the HTML‑to‑PDF service on its official website (foxit.com). Any deployment of that service that accepts public input is impacted; no specific version information is provided.

The CVSS score of 7.5 indicates a high severity. Although the EPSS score is not available, the ability to gather internal network topology is a critical asset in many compromise chains, and the service is exposed to the internet, providing an obvious attack vector. The vulnerability is not yet listed in CISA KEV, but that does not diminish its exploitability potential.