---
id: "CVE-2026-111036"
kind: "vulnerability"
aliases: ["CVE-2026-111036"]
title: "Coupa Supplier Portal: SSRF via DOCX template conversion leaks internal data"
severity: "high"
cvss: 8.4
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["coupa", "saas", "ssrf", "supplier-portal", "vendor"]
not_affected_if: ["managed-hosting", "no-template-edit-permission"]
published_at: "2026-11-04T10:17:24+00:00"
first_seen_at: "2026-11-04T10:26:34+00:00"
updated_at: "2026-11-04T10:29:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111036", "first_seen_at": "2026-11-04T10:26:34+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T10:29:35+00:00"}]
---

# Coupa Supplier Portal: SSRF via DOCX template conversion leaks internal data

Coupa Supplier Portal's DOCX-to-PDF conversion in Contracts > Templates does not validate external references in uploaded documents. An authenticated user who can edit templates can make the server fetch attacker-chosen URLs, internal network resources or local files, exposing configuration, credentials and environment variables.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Coupa hosts this SaaS service, so there is nothing to scan for. Check who in your tenant has permission to edit Contracts > Templates and review recent template uploads (DOCX files) for unexpected external references. Ask Coupa for patch status.

## Fix

No fix or patch reported yet (INCIBE advisory INCIBE-2026-836, 2026-11-04). Coupa has not published its own notice that I could find.

## Timeline

- 2026-11-04T10:26:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111036
- 2026-11-04T10:29:35+00:00 analyst — Only INCIBE (CNA coordinator, not the vendor) advisory found; it says no solution reported yet. No Coupa vendor notice found, so nothing marked verified. No exploitation or PoC seen. Sibling CVEs: 111037, 111038, 111040.

## Documents

- [advisory] INCIBE-CERT: Multiple vulnerabilities in Coupa's Total Spend Management Platform https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-coupas-total-spend-management-platform

## From the sources

Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functionality available in the ‘Contracts > Templates’ section. The vulnerability is due to insufficient validation of references to external resources processed by the Aspose.Words for Java library during DOCX-to-PDF conversion. An authenticated attacker with permissions to modify templates could upload a specially crafted DOCX document containing references to external resources, which would cause the server-side application to access URLs controlled by the attacker, resources on the internal network, or local files. A successful exploit could lead to the disclosure of sensitive information, such as configuration files, system files, credentials, environment variables and endpoints for internal services.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_