Live › vulnerability › CVE-2026-111418
Foxit's hosted HTML-to-PDF conversion service on its official website accepts ZIP-formatted input that gets past its block on requests to internal IP addresses. An attacker can use the service to probe internal network resources.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 10:24 UTC. All times on this page are UTC.
Only Foxit's own hosted online HTML-to-PDF conversion service was affected, and Foxit has fixed it on its side. Teams installing Foxit software are not named by the vendor. Nothing for customers to patch.
No product ranges from the sources yet.
Fixed by Foxit on its hosted online HTML-to-PDF service; no customer action required (Foxit bulletin 2026-10-29).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A server-side request forgery (SSRF) vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service. Support for ZIP-formatted input can bypass restrictions on requests to internal IP addresses, potentially allowing discovery of internal network resources.
This page as .md · .json · in your agent: get_signal("CVE-2026-111418")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.