{"id":"CVE-2026-111036","kind":"vulnerability","aliases":["CVE-2026-111036"],"related":[],"title":"Coupa Supplier Portal: SSRF via DOCX template conversion leaks internal data","description":"Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functionality available in the ‘Contracts > Templates’ section. The vulnerability is due to insufficient validation of references to external resources processed by the Aspose.Words for Java library during DOCX-to-PDF conversion. An authenticated attacker with permissions to modify templates could upload a specially crafted DOCX document containing references to external resources, which would cause the server-side application to access URLs controlled by the attacker, resources on the internal network, or local files. A successful exploit could lead to the disclosure of sensitive information, such as configuration files, system files, credentials, environment variables and endpoints for internal services.","summary":"Coupa Supplier Portal's DOCX-to-PDF conversion in Contracts > Templates does not validate external references in uploaded documents. An authenticated user who can edit templates can make the server fetch attacker-chosen URLs, internal network resources or local files, exposing configuration, credentials and environment variables.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["coupa","saas","ssrf","supplier-portal","vendor"],"not_affected_if":["managed-hosting","no-template-edit-permission"],"how_to_check":"Coupa hosts this SaaS service, so there is nothing to scan for. Check who in your tenant has permission to edit Contracts > Templates and review recent template uploads (DOCX files) for unexpected external references. Ask Coupa for patch status.","fix":"No fix or patch reported yet (INCIBE advisory INCIBE-2026-836, 2026-11-04). Coupa has not published its own notice that I could find.","status":"open","published_at":"2026-11-04T10:17:24+00:00","first_seen_at":"2026-11-04T10:26:34+00:00","triaged_at":"2026-11-04T10:27:10+00:00","updated_at":"2026-11-04T10:29:35+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-04T10:27:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Coupa Supplier Portal: SSRF via DOCX template conversion leaks internal data","impact":"high","summary":"Coupa Supplier Portal's DOCX-to-PDF conversion in Contracts > Templates does not validate external references in uploaded documents. An authenticated user who can edit templates can make the server fetch attacker-chosen URLs, internal network resources or local files, exposing configuration, credentials and environment variables.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["coupa","saas","supplier-portal"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Server reads internal files, credentials and environment variables","analyst_note":"Check Coupa's vendor notice for patch status and affected tenants; the NVD entry does not state a fix.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["managed-hosting","no-template-edit-permission"],"who_is_affected":"Only the Coupa Supplier Portal SaaS platform is named; it is a hosted service, so the company's own systems are not the ones to patch. Exposure requires an account with permission to modify contract templates. Companies that use Coupa Supplier Portal for supplier onboarding or contracts should review vendor notices and ask Coupa for status.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000687,"input_tokens":4276,"output_tokens":518,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Coupa's vendor notice for patch status and affected tenants; the NVD entry does not state a fix.","search":"'-111036':14A,17A '-2026':13A,16A 'access':153C 'applic':151C 'aspose.words':114C 'attack':58B,126C,158C 'attacker-chosen':57B 'authent':46B,125C 'avail':93C 'caus':146C 'chosen':59B 'configur':68B,180C 'contain':139C 'contract':35B,96C 'control':155C 'convers':8A,33B,91C,123C 'could':132C,170C 'coupa':1A,18B,25B,82C 'craft':136C 'credenti':69B,184C 'cve':12A,15A 'data':11A 'disclosur':174C 'document':44B,90C,138C 'docx':6A,30B,120C,137C 'docx-to-pdf':29B,119C 'due':102C 'edit':50B 'endpoint':188C 'environ':71B,185C 'exploit':169C 'expos':67B 'extern':40B,109C,142C 'fetch':56B 'file':66B,166C,181C,183C 'forgeri':77C 'function':92C 'inform':177C 'insuffici':104C 'intern':10A,61B,162C,190C 'java':116C 'lead':171C 'leak':9A 'librari':117C 'local':65B,165C 'make':53B 'modifi':130C 'network':62B,163C 'pdf':32B,122C 'permiss':128C 'platform':86C 'portal':3A,23B,27B,84C 'process':111C 'refer':41B,107C,140C 'request':76C 'resourc':63B,110C,143C,159C 'saa':19B,85C 'section':98C 'sensit':176C 'server':55B,74C,149C 'server-sid':73C,148C 'servic':191C 'side':75C,150C 'special':135C 'specif':87C 'ssrf':4A,20B,78C 'success':168C 'supplier':2A,22B,26B,83C 'supplier-port':21B 'system':182C 'templat':7A,36B,51B,97C,131C 'upload':43B,133C 'url':60B,154C 'user':47B 'valid':39B,105C 'variabl':72B,186C 'vendor':24B 'via':5A 'vulner':79C,100C 'would':145C","nicknames":[],"mitigations":[],"who_affected":"Coupa Supplier Portal (SaaS), part of Coupa Total Spend Management Platform. Exposure needs an authenticated account with permission to modify contract templates in Contracts > Templates; the DOCX-to-PDF conversion (Aspose.Words for Java) can then be made to fetch attacker-chosen URLs, internal resources or local files. Teams without template-edit permissions for untrusted users are at lower risk. Because Coupa hosts the service, only Coupa can patch it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["coupa","high","saas","ssrf","supplierportal","vendor"],"campaign_type":null,"first_public_at":"2026-11-04T10:17:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve-coordination@incibe.es","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111036","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111036","severity":null,"published_at":"2026-11-04T10:17:24+00:00","modified_at":"2026-11-04T10:17:24+00:00","first_seen_at":"2026-11-04T10:26:34+00:00","fetched_at":"2026-11-04T10:26:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111036:1660","url":null,"severity":null,"published_at":"2026-11-04T10:29:35+00:00","modified_at":"2026-11-04T10:29:35+00:00","first_seen_at":"2026-11-04T10:29:35+00:00","fetched_at":"2026-11-04T10:29:35+00:00","note":"Only INCIBE (CNA coordinator, not the vendor) advisory found; it says no solution reported yet. No Coupa vendor notice found, so nothing marked verified. No exploitation or PoC seen. Sibling CVEs: 111037, 111038, 111040."}],"documents":[{"id":66162,"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-coupas-total-spend-management-platform","title":"INCIBE-CERT: Multiple vulnerabilities in Coupa's Total Spend Management Platform","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}