CVE-2026-5936

An attacker can control a server-side HTTP request by supplying a crafted URL, causing the server to initiate requests to arbitrary destinations. This behavior may be exploited to probe internal network services, access otherwise unreachable endpoints (e.g., cloud metadata services), or bypass network access controls, potentially leading to sensitive information disclosure and further compromise of the internal environment.

CVSS v3 8.5 HIGH

8.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://www.foxit.com/support/security-bulletins.html	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:foxit:pdf_services_api:*:*:*:*:*:*:*:*

History

07 Jul 2026, 18:26

Type	Values Removed	Values Added
First Time		Foxit Foxit pdf Services Api
References	~~() https://www.foxit.com/support/security-bulletins.html -~~	() https://www.foxit.com/support/security-bulletins.html - Vendor Advisory
CPE		cpe:2.3:a:foxit:pdf_services_api::::::::

13 Apr 2026, 07:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-04-13 07:16

Updated : 2026-07-07 18:26

NVD link : CVE-2026-5936

Mitre link : CVE-2026-5936

CVE.ORG link : CVE-2026-5936

JSON object : View

Products Affected

foxit

pdf_services_api

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-5936", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5936", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-13T13:50:20.644193Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "14984358-7092-470d-8f34-ade47a7658a2", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 3.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "14984358-7092-470d-8f34-ade47a7658a2", "affectedData": [{"vendor": "Foxit Software Inc.", "product": "Foxit PDF Services API", "versions": [{"status": "affected", "version": "before 2026-04-07"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-13T07:16:50.710", "references": [{"url": "https://www.foxit.com/support/security-bulletins.html", "tags": ["Vendor Advisory"], "source": "14984358-7092-470d-8f34-ade47a7658a2"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "14984358-7092-470d-8f34-ade47a7658a2", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "An attacker can control a server-side HTTP request by supplying a crafted URL, causing the server to initiate requests to arbitrary destinations. This behavior may be exploited to probe internal network services, access otherwise unreachable endpoints (e.g., cloud metadata services), or bypass network access controls, potentially leading to sensitive information disclosure and further compromise of the internal environment."}], "lastModified": "2026-07-07T18:26:51.513", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:foxit:pdf_services_api:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "07237F4D-7EA9-4226-9456-093CEF8C2688", "versionEndExcluding": "2026-04-07"}], "operator": "OR"}]}], "sourceIdentifier": "14984358-7092-470d-8f34-ade47a7658a2"}