An attacker can supply a crafted URL to the Foxit PDF Services API, causing the server to execute a request to an arbitrary destination. This Server‑Side Request Forgery (CWE‑918) enables probing of internal services, retrieval of data from cloud metadata services, and potential bypass of network controls. The disclosure of internal resources may lead to further compromise of the internal environment if additional vulnerabilities exist.

The vulnerability affects Foxit Software Inc.’s Foxit PDF Services API. No specific product versions are listed in the available CNAs, so any deployment of the API may be impacted until patching occurs.

The CVSS score of 8.5 indicates a highly critical severity. Exploit likelihood is uncertain as EPSS data is not provided, but the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, based on the fact that the vulnerability requires an attacker to send a crafted URL to a publicly accessible API endpoint. If successful, the attacker can redirect internal requests to arbitrary addresses, potentially exposing sensitive data or facilitating lateral movement.