Foxit HTML-to-PDF Conversion Service: Server-Side Request Forgery (CVE-2026-111418)

A server-side request forgery (SSRF) vulnerability, assigned CVE-2026-111418, exists in the Foxit official website's HTML-to-PDF conversion service. By submitting a ZIP-formatted input file, an attacker can bypass existing restrictions on requests, enabling the service to perform internal network requests. This vulnerability poses a risk of internal resource discovery and potentially unauthorized interaction with services located within the internal network perimeter.

Impact

Successful exploitation allows for the discovery of internal network resources that are not intended to be exposed to the public internet, potentially leading to unauthorized data access or further internal network reconnaissance.

Recommendation

1. Monitor web server logs for requests directed at the HTML-to-PDF conversion service containing ZIP archive payloads.
2. Implement strict network egress filtering for the service performing the conversion to ensure it can only reach necessary external endpoints.
3. Validate input types and block ZIP-formatted archives if not strictly required by business workflows until a patch is provided by Foxit.