{"id":"CVE-2026-119433","kind":"vulnerability","aliases":["CVE-2026-119433"],"related":[],"title":"Foxit Workspace (Foxit-hosted service): SSRF in file-upload and PDF-export, already fixed by Foxit","description":"A server-side request forgery (SSRF) vulnerability exists in an undocumented API endpoint of Foxit Workspace due to insufficient validation of user-supplied URL and network parameters. A remote attacker could exploit this issue to induce the server to send requests to arbitrary internal or external resources, potentially enabling unauthorized access to internal services, network reconnaissance, and sensitive information disclosure.","summary":"Foxit's Nov 6, 2026 bulletin says Foxit Workspace (ai.foxit.com), a Foxit-run online service, was updated to fix SSRF in its file-upload and PDF-export processes. Insufficient validation of user-supplied URLs and network parameters could let an authenticated attacker (PR:L) make the service send requests to internal or external resources and return their contents. Foxit says no customer action is required.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["foxit-workspace","managed-hosting","other","saas","self-hosted","ssrf"],"not_affected_if":["default-config","managed-hosting","unknown"],"how_to_check":"Nothing to check on your side: Foxit says the service was updated and no customer action is required. The bulletin lists no self-hosted version.","fix":"Fixed by Foxit on the hosted service (bulletin of 2026-11-06); no customer action required. No version number published.","status":"open","published_at":"2026-11-06T05:18:20+00:00","first_seen_at":"2026-11-06T05:40:17+00:00","triaged_at":"2026-11-06T05:41:11+00:00","updated_at":"2026-11-06T05:42:00+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-11-06T05:41:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Foxit Workspace: undocumented API endpoint lets attackers make server send requests","impact":"medium","summary":"An undocumented API endpoint in Foxit Workspace does not validate user-supplied URL and network parameters. A remote attacker can make the server send requests to internal or external targets, which can expose internal services and sensitive information.","audience":"businesses","category":"other","nicknames":[],"who_cares":["foxit-workspace","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Server reaches internal services and leaks sensitive information","analyst_note":"Find the affected Foxit Workspace versions, the fixed release and whether authentication is required, via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-119433 and the vendor advisory.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running Foxit Workspace servers that expose this endpoint to the network the attacker can reach. The sources do not say which versions are affected or which configurations are exposed, so the affected range is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000659,"input_tokens":4265,"output_tokens":465,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected Foxit Workspace versions, the fixed release and whether authentication is required, via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-119433 and the vendor advisory.","search":"'-119433':22A,25A '-2026':21A,24A '2026':42B '6':41B 'access':159C 'action':104B 'ai.foxit.com':47B 'alreadi':16A 'api':119C 'arbitrari':151C 'attack':83B,138C 'authent':82B 'bulletin':43B 'content':99B 'could':79B,139C 'custom':103B 'cve':20A,23A 'disclosur':168C 'due':124C 'enabl':157C 'endpoint':120C 'exist':115C 'exploit':140C 'export':15A,67B 'extern':94B,154C 'file':10A,62B 'file-upload':9A,61B 'fix':17A,57B 'forgeri':112C 'foxit':1A,4A,19A,27B,38B,45B,50B,100B,122C 'foxit-host':3A 'foxit-run':49B 'foxit-workspac':26B 'host':5A,31B,36B 'induc':144C 'inform':167C 'insuffici':69B,126C 'intern':92B,152C,161C 'issu':142C 'l':85B 'let':80B 'make':86B 'manag':30B 'managed-host':29B 'network':77B,134C,163C 'nov':40B 'onlin':52B 'paramet':78B,135C 'pdf':14A,66B 'pdf-export':13A,65B 'potenti':156C 'pr':84B 'process':68B 'reconnaiss':164C 'remot':137C 'request':90B,111C,149C 'requir':106B 'resourc':95B,155C 'return':97B 'run':51B 'saa':33B 'say':44B,101B 'self':35B 'self-host':34B 'send':89B,148C 'sensit':166C 'server':109C,146C 'server-sid':108C 'servic':6A,53B,88B,162C 'side':110C 'ssrf':7A,37B,58B,113C 'suppli':74B,131C 'unauthor':158C 'undocu':118C 'updat':55B 'upload':11A,63B 'url':75B,132C 'user':73B,130C 'user-suppli':72B,129C 'valid':70B,127C 'vulner':114C 'workspac':2A,28B,46B,123C","nicknames":[],"mitigations":[],"who_affected":"Foxit Workspace is run by Foxit at ai.foxit.com, and the vendor says it has already been updated and customers need to do nothing. The bulletin names no self-hosted edition or version. Low-privilege (logged-in) access was needed per the CVSS vector. Teams can skip this unless they run a copy of Workspace themselves, which the vendor does not describe.","tier":"B","verified":{"fix":{"at":"2026-11-06T05:42:00Z","by":"analyst","doc":"https://www.foxit.com/support/security-bulletins/","run_id":1858},"who_affected":{"at":"2026-11-06T05:42:00Z","by":"analyst","doc":"https://www.foxit.com/support/security-bulletins/","run_id":1858}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["foxitworkspace","high","managedhosting","other","saas","selfhosted","ssrf"],"campaign_type":null,"search_a":"'-119433':22A,25A '-2026':21A,24A 'alreadi':16A 'cve':20A,23A 'export':15A 'file':10A 'file-upload':9A 'fix':17A 'foxit':1A,4A,19A 'foxit-host':3A 'host':5A 'pdf':14A 'pdf-export':13A 'servic':6A 'ssrf':7A 'upload':11A 'workspac':2A","search_b":"'2026':42B '6':41B 'action':104B 'ai.foxit.com':47B 'attack':83B 'authent':82B 'bulletin':43B 'content':99B 'could':79B 'custom':103B 'export':67B 'extern':94B 'file':62B 'file-upload':61B 'fix':57B 'foxit':27B,38B,45B,50B,100B 'foxit-run':49B 'foxit-workspac':26B 'host':31B,36B 'insuffici':69B 'intern':92B 'l':85B 'let':80B 'make':86B 'manag':30B 'managed-host':29B 'network':77B 'nov':40B 'onlin':52B 'paramet':78B 'pdf':66B 'pdf-export':65B 'pr':84B 'process':68B 'request':90B 'requir':106B 'resourc':95B 'return':97B 'run':51B 'saa':33B 'say':44B,101B 'self':35B 'self-host':34B 'send':89B 'servic':53B,88B 'ssrf':37B,58B 'suppli':74B 'updat':55B 'upload':63B 'url':75B 'user':73B 'user-suppli':72B 'valid':70B 'workspac':28B,46B","search_c":"'access':159C 'api':119C 'arbitrari':151C 'attack':138C 'could':139C 'disclosur':168C 'due':124C 'enabl':157C 'endpoint':120C 'exist':115C 'exploit':140C 'extern':154C 'forgeri':112C 'foxit':122C 'induc':144C 'inform':167C 'insuffici':126C 'intern':152C,161C 'issu':142C 'network':134C,163C 'paramet':135C 'potenti':156C 'reconnaiss':164C 'remot':137C 'request':111C,149C 'resourc':155C 'send':148C 'sensit':166C 'server':109C,146C 'server-sid':108C 'servic':162C 'side':110C 'ssrf':113C 'suppli':131C 'unauthor':158C 'undocu':118C 'url':132C 'user':130C 'user-suppli':129C 'valid':127C 'vulner':114C 'workspac':123C","first_public_at":"2026-11-06T05:18:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"14984358-7092-470d-8f34-ade47a7658a2","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119433","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119433","severity":null,"published_at":"2026-11-06T05:18:20+00:00","modified_at":"2026-11-06T05:18:20+00:00","first_seen_at":"2026-11-06T05:40:17+00:00","fetched_at":"2026-11-06T05:40:17+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119433:1858","url":"https://www.foxit.com/support/security-bulletins/","severity":null,"published_at":"2026-11-06T05:42:00+00:00","modified_at":"2026-11-06T05:42:00+00:00","first_seen_at":"2026-11-06T05:42:00+00:00","fetched_at":"2026-11-06T05:42:00+00:00","note":"Foxit bulletin (primary) covers CVE-2026-119433 as SSRF in file-upload/PDF-export in the hosted Foxit Workspace; PR:L per CVSS vector; no customer action; no exploitation or PoC noted. Triage's self-hosted tag was unsupported, replaced. Did not search social posts: low-profile.","cites":["https://www.foxit.com/support/security-bulletins/","https://nvd.nist.gov/vuln/detail/CVE-2026-119433"]}],"documents":[{"id":15803,"url":"https://www.foxit.com/support/security-bulletins/","title":"Foxit Security Bulletins: Foxit Workspace security update (Nov 6, 2026)","kind":"vendor","source":"analyst","publisher":null,"text":"Security enhancements for Foxit online services. Release date: October 29, 2026. Summary: Foxit has fixed broken access control, server-side request forgery (SSRF), and hardcoded API token exposure issues to enhance security. No customer action is required. Addressed potential broken access control and SSRF issues in the online HTML-to-PDF conversion service, which attackers could exploit to access or discover unintended resources under certain conditions. CVE-2026-111417.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":83776,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119433","title":"NVD CVE-2026-119433","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}