An attacker can control a server-side HTTP request by supplying a crafted URL, causing the server to initiate requests to arbitrary destinations. This behavior may be exploited to probe internal network services, access otherwise unreachable endpoints (e.g., cloud metadata services), or bypass network access controls, potentially leading to sensitive information disclosure and further compromise of the internal environment.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
| Link | Providers |
|---|---|
| https://www.foxit.com/support/security-bulletins.html |
|
History
Mon, 13 Apr 2026 07:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An attacker can control a server-side HTTP request by supplying a crafted URL, causing the server to initiate requests to arbitrary destinations. This behavior may be exploited to probe internal network services, access otherwise unreachable endpoints (e.g., cloud metadata services), or bypass network access controls, potentially leading to sensitive information disclosure and further compromise of the internal environment. | |
| Title | Server-Side Request Forgery (SSRF) via URL Parameter in Foxit PDF Services API | |
| Weaknesses | CWE-918 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Foxit
Published:
Updated: 2026-04-13T06:57:40.220Z
Reserved: 2026-04-09T03:41:58.832Z
Link: CVE-2026-5936
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-04-13T07:16:50.710
Modified: 2026-04-13T07:16:50.710
Link: CVE-2026-5936
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses