Read the docs
TI-2026-05206 Aliases CVE-2026-5936GHSA-xq5v-qh4w-535c

Server-Side Request Forgery (SSRF) via URL Parameter in Foxit PDF Services API

Priority MEDIUM 41CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

An attacker can control a server-side HTTP request by supplying a crafted URL, causing the server to initiate requests to arbitrary destinations. This behavior may be exploited to probe internal network services, access otherwise unreachable endpoints (e.g., cloud metadata services), or bypass network access controls, potentially leading to sensitive information disclosure and further compromise of the internal environment.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00195 9th percentileScored 2026-11-07
Fix Fixed Foxit PDF Services API (Foxit Software Inc.): 2026-04-07

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Foxit Software Inc.Foxit PDF Services APIbefore 2026-04-072026-04-07Patch availableCNA
  • Foxit PDF Services API VendorFoxit Software Inc. Affected before 2026-04-07 Fixed in 2026-04-07 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:foxit:pdf_services_api:*:*:*:*:*:*:*:*before 2026-04-07VulnerableFoxit
  • cpe:2.3:a:foxit:pdf_services_api:*:*:*:*:*:*:*:* Versions before 2026-04-07 Vulnerable ·Foxit

Remediation

  • Fix · CNA Foxit PDF Services API (Foxit Software Inc.) Fixed in 2026-04-07

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-5936
  2. 2026-10-03 Alias added: GHSA-xq5v-qh4w-535c

References

Advisory 1

  • TI-2011-04633 Foxit PDF Reader < 4.3.1.0218 JavaScript File Write CVSS 4.0HIGH 8.4
  • TI-2016-06851 Out-of-bounds read in Foxit Reader CVSS 3.0MEDIUM 6.8
  • TI-2018-02932 Use after free in Foxit PDF Reader CVSS 3.1HIGH 7.8
  • TI-2018-02965 Use after free in Foxit PDF Reader CVSS 3.1HIGH 8.8
  • TI-2018-02964 Use after free in Foxit PDF Reader CVSS 3.1HIGH 8.8
  • TI-2018-02962 Use after free in Foxit PDF Reader CVSS 3.1HIGH 8.8
See all 120 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences