---
id: "CVE-2026-119433"
page: "https://infrastack.ai/live/CVE-2026-119433"
kind: "vulnerability"
aliases: ["CVE-2026-119433"]
title: "Foxit Workspace (Foxit-hosted service): SSRF in file-upload and PDF-export, already fixed by Foxit"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["foxit-workspace", "managed-hosting", "other", "saas", "self-hosted", "ssrf"]
not_affected_if: ["default-config", "managed-hosting", "unknown"]
published_at: "2026-11-06T05:18:20+00:00"
first_seen_at: "2026-11-06T05:40:17+00:00"
updated_at: "2026-11-06T05:42:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119433", "first_seen_at": "2026-11-06T05:40:17+00:00"}, {"source": "analyst", "url": "https://www.foxit.com/support/security-bulletins/", "first_seen_at": "2026-11-06T05:42:00+00:00", "cites": ["https://www.foxit.com/support/security-bulletins/", "https://nvd.nist.gov/vuln/detail/CVE-2026-119433"]}]
exploit_sources: []
---

# Foxit Workspace (Foxit-hosted service): SSRF in file-upload and PDF-export, already fixed by Foxit

Link for people: https://infrastack.ai/live/CVE-2026-119433 (this .md is for agents)

Foxit's Nov 6, 2026 bulletin says Foxit Workspace (ai.foxit.com), a Foxit-run online service, was updated to fix SSRF in its file-upload and PDF-export processes. Insufficient validation of user-supplied URLs and network parameters could let an authenticated attacker (PR:L) make the service send requests to internal or external resources and return their contents. Foxit says no customer action is required.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Nothing to check on your side: Foxit says the service was updated and no customer action is required. The bulletin lists no self-hosted version.

## Fix

Fixed by Foxit on the hosted service (bulletin of 2026-11-06); no customer action required. No version number published.

## Timeline

- 2026-11-06T05:40:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119433
- 2026-11-06T05:42:00+00:00 analyst https://www.foxit.com/support/security-bulletins/ — Foxit bulletin (primary) covers CVE-2026-119433 as SSRF in file-upload/PDF-export in the hosted Foxit Workspace; PR:L per CVSS vector; no customer action; no exploitation or PoC noted. Triage's self-hosted tag was unsupported, replaced. Did not search social posts: low-profile.

## Documents

- [advisory] Foxit Security Bulletins: Foxit Workspace security update (Nov 6, 2026) https://www.foxit.com/support/security-bulletins/
- [describes] NVD CVE-2026-119433 https://nvd.nist.gov/vuln/detail/CVE-2026-119433

## From the sources

A server-side request forgery (SSRF) vulnerability exists in an undocumented API endpoint of Foxit Workspace due to insufficient validation of user-supplied URL and network parameters. A remote attacker could exploit this issue to induce the server to send requests to arbitrary internal or external resources, potentially enabling unauthorized access to internal services, network reconnaissance, and sensitive information disclosure.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_