Read the docs
TI-2026-85004 Aliases CVE-2026-111036GHSA-5rf7-5f5j-9m5j

Server-side request forgery in Coupa Total Spend Management Platform

Priority LOW 37CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Coupa Total Spend Management Platform versions before 04/11/2024 are affected. The document conversion in the Contracts Templates section does not validate external resource references in DOCX files processed by Aspose.Words for Java, which causes server-side request forgery (CWE-918). An authenticated attacker who can modify templates can upload a crafted DOCX file to make the server access attacker-chosen URLs, internal network resources or local files. Successful exploitation can disclose sensitive information such as credentials, environment variables and configuration files.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functionality available in the ‘Contracts > Templates’ section. The vulnerability is due to insufficient validation of references to external resources processed by the Aspose.Words for Java library during DOCX-to-PDF conversion. An authenticated attacker with permissions to modify templates could upload a specially crafted DOCX document containing references to external resources, which would cause the server-side application to access URLs controlled by the attacker, resources on the internal network, or local files. A successful exploit could lead to the disclosure of sensitive information, such as configuration files, system files, credentials, environment variables and endpoints for internal services.

Why it matters now

EPSS 0.00413 35th percentileScored 2026-11-07
Fix Fixed Coupa Total Spend Management Platform (Coupa): 04/11/2024

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
CoupaCoupa Total Spend Management Platformbefore 04/11/202404/11/2024Patch availableCNA
  • Coupa Total Spend Management Platform VendorCoupa Affected before 04/11/2024 Fixed in 04/11/2024 Patch available CNA

Remediation

Coupa Total Spend Management Platform is fixed in version 04/11/2024.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA Coupa Total Spend Management Platform (Coupa) Fixed in 04/11/2024

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-111036
  2. 2026-11-04 Fix available: Coupa/Coupa Total Spend Management Platform@04/11/2024 · CNA
  3. 2026-11-04 Alias added: GHSA-5rf7-5f5j-9m5j
  4. 2026-11-05 Priority changed: MEDIUM → LOW

References

Other 1

  • TI-2026-85006 CSV formula injection in Coupa Total Spend Management Platform exports CVSS 4.0HIGH 7.3
  • TI-2026-85005 Reflected cross-site scripting in Coupa Total Spend Management CVSS 4.0MEDIUM 5.1
  • TI-2026-85010 Stored HTML injection in Coupa Total Spend Management Platform CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences