CVE-2026-5936

Server-Side Request Forgery (SSRF) via URL Parameter in Foxit PDF Services API

Published Apr 13, 2026 CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Description

An attacker can control a server-side HTTP request by supplying a crafted URL, causing the server to initiate requests to arbitrary destinations. This behavior may be exploited to probe internal network services, access otherwise unreachable endpoints (e.g., cloud metadata services), or bypass network access controls, potentially leading to sensitive information disclosure and further compromise of the internal environment.

Analysis

Technical impact

An attacker can supply a crafted URL to the Foxit PDF Services API, causing the server to execute a request to an arbitrary destination. This Server‑Side Request Forgery (CWE‑918) enables probing of internal services, retrieval of data from cloud metadata services, and potential bypass of network controls. The disclosure of internal resources may lead to further compromise of the internal environment if additional vulnerabilities exist.

Affected Systems

The vulnerability affects Foxit Software Inc.’s Foxit PDF Services API. No specific product versions are listed in the available CNAs, so any deployment of the API may be impacted until patching occurs.

Risk and Exploitability

The CVSS score of 8.5 indicates a highly critical severity. Exploit likelihood is uncertain as EPSS data is not provided, but the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, based on the fact that the vulnerability requires an attacker to send a crafted URL to a publicly accessible API endpoint. If successful, the attacker can redirect internal requests to arbitrary addresses, potentially exposing sensitive data or facilitating lateral movement.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Foxit Software Inc.

Foxit PDF Services API

unaffected

Version	Status	Constraints
`before 2026-04-07`	affected	—

Configuration 1 [-]

cpe:2.3:a:foxit:pdf_services_api:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Foxitsoftware

Foxit Pdf Services Api

Version	Status	Scheme	Platform
`[0,2026-04-07)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest Foxit Firmware or software update for the PDF Services API as announced by Foxit Security Bulletin
Restrict outbound network traffic from the API to a whitelist of approved IP addresses or destinations, blocking unauthorized internal or external targets
Enable logging and monitoring of outgoing HTTP requests to detect anomalous or unexpected URL patterns that may indicate SSRF exploitation attempts

Generated by OpenCVE AI on April 13, 2026 at 08:51 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.199% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.foxit.com/support/security-bulletins.html

History

Apr 13, 2026 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 13, 2026 1:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Foxitsoftware Foxitsoftware foxit Pdf Services Api
Vendors & Products		Foxitsoftware Foxitsoftware foxit Pdf Services Api

Apr 13, 2026 7:15 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		An attacker can control a server-side HTTP request by supplying a crafted URL, causing the server to initiate requests to arbitrary destinations. This behavior may be exploited to probe internal network services, access otherwise unreachable endpoints (e.g., cloud metadata services), or bypass network access controls, potentially leading to sensitive information disclosure and further compromise of the internal environment.
Title		Server-Side Request Forgery (SSRF) via URL Parameter in Foxit PDF Services API
Weaknesses		CWE-918
References		https://www.foxit.com/support/security-bulletins.html
Metrics		cvssV3_1 `{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N'}`