CVE-2026-111036 · Vendor
NO FIX YET · SEE WHAT TO DO
Coupa Supplier Portal's DOCX-to-PDF conversion in Contracts > Templates does not validate external references in uploaded documents. An authenticated user who can edit templates can make the server fetch attacker-chosen URLs, internal network resources or local files, exposing configuration, credentials and environment variables.
first public Nov 4, 2026 · 2 sources
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Coupa Supplier Portal (SaaS), part of Coupa Total Spend Management Platform. Exposure needs an authenticated account with permission to modify contract templates in Contracts > Templates; the DOCX-to-PDF conversion (Aspose.Words for Java) can then be made to fetch attacker-chosen URLs, internal resources or local files. Teams without template-edit permissions for untrusted users are at lower risk. Because Coupa hosts the service, only Coupa can patch it.
Not affected if managed-hosting, no-template-edit-permission
Who cares coupa, saas, ssrf, supplier-portal
Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functionality available in the ‘Contracts > Templates’ section. The vulnerability is due to insufficient validation of references to external resources processed by the Aspose.Words for Java library during DOCX-to-PDF conversion. An authenticated attacker with permissions to modify templates could upload a specially crafted DOCX document containing references to external resources, which would cause the server-side application to access URLs controlled by the attacker, resources on the internal network, or local files. A successful exploit could lead to the disclosure of sensitive information, such as configuration files, system files, credentials, environment variables and endpoints for internal services.
This page as .md · .json · in your agent: get_signal("CVE-2026-111036") · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.