Foxit foxit.com HTML-to-PDF service: Server-side request forgery
Summary
The online HTML-to-PDF conversion service on Foxit's official website contains a server-side request forgery (SSRF) flaw. By submitting ZIP-formatted input, an unauthenticated remote attacker can bypass restrictions on requests to internal IP addresses and may discover internal network resources. The vulnerability affects Foxit's hosted service, not customer installations, and Foxit states that the fix was released on 29 October 2026.
Affected
- Foxit online HTML-to-PDF conversion service on foxit.com (CNA record: before 2026-10-29)
- Desktop Foxit PDF Reader and PDF Editor are not linked to this CVE in the sources reviewed
- VulDB lists a different product mapping (Foxit PDF up to 2025.3 Conversion Service); this conflicts with the CNA record and is unconfirmed
Fixed in
- Fix released by Foxit on 29 October 2026 (server-side, no customer version number)
- Exact fixed build: Unknown.
Workaround
Unknown.
- No customer-side workaround is described in the sources reviewed.
Exploitation
- Exploited in the wild: not known.
- Public exploit or PoC: VulDB states none is publicly available.
- CISA KEV: not listed.
- EPSS: 0.43 %.
- CISA SSVC: Automatable yes, technical impact partial.
Our recommendation
- Your SME is only exposed if staff or applications send documents to Foxit's online converter. Check this and treat it as a third-party data-handling risk.
- Do not send confidential documents to the online converter until Foxit confirms the fix status for that service.
- Check your own HTML-to-PDF pipelines for SSRF; block requests to private and loopback addresses and validate resolved IPs before connecting.
- Monitor the Foxit security bulletin page.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Foxit Security Bulletins www.foxit.com
- CVE record (threatint) cve.threatint.com
- Strix CVE-2026-111418 www.strix.ai
- OffSeq CVE-2026-111418 radar.offseq.com
- VulDB CVE-2026-111418 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 11:31.
Original description (NVD)
A server-side request forgery (SSRF) vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service. Support for ZIP-formatted input can bypass restrictions on requests to internal IP addresses, potentially allowing discovery of internal network resources.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.