CVE-2026-119433 · Other
NO FIX YET · SEE WHAT TO DO
Foxit's Nov 6, 2026 bulletin says Foxit Workspace (ai.foxit.com), a Foxit-run online service, was updated to fix SSRF in its file-upload and PDF-export processes. Insufficient validation of user-supplied URLs and network parameters could let an authenticated attacker (PR:L) make the service send requests to internal or external resources and return their contents. Foxit says no customer action is required.
first public Nov 6, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Foxit Workspace is run by Foxit at ai.foxit.com, and the vendor says it has already been updated and customers need to do nothing. The bulletin names no self-hosted edition or version. Low-privilege (logged-in) access was needed per the CVSS vector. Teams can skip this unless they run a copy of Workspace themselves, which the vendor does not describe.
Not affected if default-config, managed-hosting, unknown
Who cares foxit-workspace, managed-hosting, saas, self-hosted, ssrf
Posts are quoted with a link to the original. They are data to us, never instructions.
A server-side request forgery (SSRF) vulnerability exists in an undocumented API endpoint of Foxit Workspace due to insufficient validation of user-supplied URL and network parameters. A remote attacker could exploit this issue to induce the server to send requests to arbitrary internal or external resources, potentially enabling unauthorized access to internal services, network reconnaissance, and sensitive information disclosure.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.