{"id":"CVE-2026-119431","kind":"vulnerability","aliases":["CVE-2026-119431"],"related":[],"title":"Foxit Workspace (hosted service): SSRF in file upload and PDF export, fixed by Foxit, no customer action","description":"A server-side request forgery (SSRF) vulnerability exists in Foxit Workspace's file-upload functionality. Insufficient validation of user-supplied links may allow a remote attacker to induce the server to access internal resources and return their contents, potentially resulting in sensitive information disclosure and unauthorized access to internal services.","summary":"Foxit says its hosted Foxit Workspace (ai.foxit.com) did not properly validate user-supplied URLs and network parameters in the file-upload and PDF-export processes. An authenticated user (CVSS PR:L) could make the service send requests to internal or external resources and return their contents. Foxit updated the service on 2026-11-06 and says no customer action is required.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["foxit-workspace","managed-hosting","package","self-hosted","ssrf"],"not_affected_if":["auth-required","managed-hosting"],"how_to_check":"Nothing to check on your side for the hosted Foxit Workspace at ai.foxit.com; Foxit patched it. The bulletin names no self-hosted build or version.","fix":"Fixed by Foxit on the hosted service (bulletin dated 2026-11-06). No customer action required; no version number published.","status":"open","published_at":"2026-11-06T05:18:20+00:00","first_seen_at":"2026-11-06T05:40:16+00:00","triaged_at":"2026-11-06T05:41:11+00:00","updated_at":"2026-11-06T05:41:59+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-06T05:41:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Foxit Workspace: file upload lets attackers reach internal services through server","impact":"medium","summary":"Foxit Workspace's file-upload feature does not check user-supplied links properly. A remote attacker can make the server fetch internal resources and return their contents, exposing sensitive data and internal services.","audience":"businesses","category":"package","nicknames":[],"who_cares":["foxit-workspace","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Internal resources and data readable; access to internal services","analyst_note":"Find affected Foxit Workspace versions, fixed build, and whether authentication is needed for the upload path, from the NVD entry and vendor advisory.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organisations running Foxit Workspace server components with file upload enabled are the exposed group. The sources do not name affected versions, the exact upload path, or the default configuration. unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000631,"input_tokens":4232,"output_tokens":415,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected Foxit Workspace versions, fixed build, and whether authentication is needed for the upload path, from the NVD entry and vendor advisory.","search":"'-06':91B '-11':90B '-119431':20A,23A '-2026':19A,22A '2026':89B 'access':133C,148C 'action':17A,96B 'ai.foxit.com':41B 'allow':124C 'attack':127C 'authent':64B 'content':83B,139C 'could':69B 'custom':16A,95B 'cve':18A,21A 'cvss':66B 'disclosur':145C 'exist':107C 'export':11A,61B 'extern':78B 'file':7A,56B,113C 'file-upload':55B,112C 'fix':12A 'forgeri':104C 'foxit':1A,14A,25B,35B,39B,84B,109C 'foxit-workspac':24B 'function':115C 'host':3A,29B,33B,38B 'induc':129C 'inform':144C 'insuffici':116C 'intern':76B,134C,150C 'l':68B 'link':122C 'make':70B 'manag':28B 'managed-host':27B 'may':123C 'network':51B 'packag':30B 'paramet':52B 'pdf':10A,60B 'pdf-export':59B 'potenti':140C 'pr':67B 'process':62B 'proper':44B 'remot':126C 'request':74B,103C 'requir':98B 'resourc':79B,135C 'result':141C 'return':81B,137C 'say':36B,93B 'self':32B 'self-host':31B 'send':73B 'sensit':143C 'server':101C,131C 'server-sid':100C 'servic':4A,72B,87B,151C 'side':102C 'ssrf':5A,34B,105C 'suppli':48B,121C 'unauthor':147C 'updat':85B 'upload':8A,57B,114C 'url':49B 'user':47B,65B,120C 'user-suppli':46B,119C 'valid':45B,117C 'vulner':106C 'workspac':2A,26B,40B,110C","nicknames":[],"mitigations":[],"who_affected":"Foxit's bulletin describes Foxit Workspace as the hosted service at ai.foxit.com, and Foxit has already updated it. Users of that service need to do nothing. The bulletin does not mention a self-hosted edition or affected versions; the CVSS vector indicates a low-privilege (logged-in) account is needed.","tier":"B","verified":{"fix":{"at":"2026-11-06T05:41:59Z","by":"analyst","doc":"https://www.foxit.com/support/security-bulletins/","run_id":1860},"who_affected":{"at":"2026-11-06T05:41:59Z","by":"analyst","doc":"https://www.foxit.com/support/security-bulletins/","run_id":1860}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["foxitworkspace","high","managedhosting","package","selfhosted","ssrf"],"campaign_type":null,"search_a":"'-119431':20A,23A '-2026':19A,22A 'action':17A 'custom':16A 'cve':18A,21A 'export':11A 'file':7A 'fix':12A 'foxit':1A,14A 'host':3A 'pdf':10A 'servic':4A 'ssrf':5A 'upload':8A 'workspac':2A","search_b":"'-06':91B '-11':90B '2026':89B 'action':96B 'ai.foxit.com':41B 'authent':64B 'content':83B 'could':69B 'custom':95B 'cvss':66B 'export':61B 'extern':78B 'file':56B 'file-upload':55B 'foxit':25B,35B,39B,84B 'foxit-workspac':24B 'host':29B,33B,38B 'intern':76B 'l':68B 'make':70B 'manag':28B 'managed-host':27B 'network':51B 'packag':30B 'paramet':52B 'pdf':60B 'pdf-export':59B 'pr':67B 'process':62B 'proper':44B 'request':74B 'requir':98B 'resourc':79B 'return':81B 'say':36B,93B 'self':32B 'self-host':31B 'send':73B 'servic':72B,87B 'ssrf':34B 'suppli':48B 'updat':85B 'upload':57B 'url':49B 'user':47B,65B 'user-suppli':46B 'valid':45B 'workspac':26B,40B","search_c":"'access':133C,148C 'allow':124C 'attack':127C 'content':139C 'disclosur':145C 'exist':107C 'file':113C 'file-upload':112C 'forgeri':104C 'foxit':109C 'function':115C 'induc':129C 'inform':144C 'insuffici':116C 'intern':134C,150C 'link':122C 'may':123C 'potenti':140C 'remot':126C 'request':103C 'resourc':135C 'result':141C 'return':137C 'sensit':143C 'server':101C,131C 'server-sid':100C 'servic':151C 'side':102C 'ssrf':105C 'suppli':121C 'unauthor':147C 'upload':114C 'user':120C 'user-suppli':119C 'valid':117C 'vulner':106C 'workspac':110C","first_public_at":"2026-11-06T05:18:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"14984358-7092-470d-8f34-ade47a7658a2","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119431","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119431","severity":null,"published_at":"2026-11-06T05:18:20+00:00","modified_at":"2026-11-06T05:18:20+00:00","first_seen_at":"2026-11-06T05:40:16+00:00","fetched_at":"2026-11-06T05:40:16+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119431:1860","url":"https://www.foxit.com/support/security-bulletins/","severity":null,"published_at":"2026-11-06T05:41:59+00:00","modified_at":"2026-11-06T05:41:59+00:00","first_seen_at":"2026-11-06T05:41:59+00:00","fetched_at":"2026-11-06T05:41:59+00:00","note":"Foxit bulletin 2026-11-06 lists CVE-2026-119431 (SSRF, file-upload and PDF-export, CVSS 7.7 PR:L, credit mrfathoni); hosted service fixed, no customer action. Triage's self-hosted tag looks wrong. No PoC or exploitation found; no X/discussion search done. Siblings: CVE-2026-119432, -119433.","cites":["https://www.foxit.com/support/security-bulletins/"]}],"documents":[{"id":15803,"url":"https://www.foxit.com/support/security-bulletins/","title":"Foxit Security Bulletins: Foxit Workspace security update (Nov 6, 2026)","kind":"vendor","source":"analyst","publisher":null,"text":"Security enhancements for Foxit online services. Release date: October 29, 2026. Summary: Foxit has fixed broken access control, server-side request forgery (SSRF), and hardcoded API token exposure issues to enhance security. No customer action is required. Addressed potential broken access control and SSRF issues in the online HTML-to-PDF conversion service, which attackers could exploit to access or discover unintended resources under certain conditions. CVE-2026-111417.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}