{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3afoxithtml-to-pdf_conversion_service/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:foxit:html-to-pdf_conversion_service:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-111418"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["HTML-to-PDF conversion service"],"_cs_severities":["high"],"_cs_tags":["ssrf","web-vulnerability","cloud"],"_cs_type":"advisory","_cs_vendors":["Foxit"],"content_html":"\u003cp\u003eA server-side request forgery (SSRF) vulnerability, assigned CVE-2026-111418, exists in the Foxit official website's HTML-to-PDF conversion service. By submitting a ZIP-formatted input file, an attacker can bypass existing restrictions on requests, enabling the service to perform internal network requests. This vulnerability poses a risk of internal resource discovery and potentially unauthorized interaction with services located within the internal network perimeter.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the discovery of internal network resources that are not intended to be exposed to the public internet, potentially leading to unauthorized data access or further internal network reconnaissance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eMonitor web server logs for requests directed at the HTML-to-PDF conversion service containing ZIP archive payloads.\u003c/li\u003e\n\u003cli\u003eImplement strict network egress filtering for the service performing the conversion to ensure it can only reach necessary external endpoints.\u003c/li\u003e\n\u003cli\u003eValidate input types and block ZIP-formatted archives if not strictly required by business workflows until a patch is provided by Foxit.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-29T11:14:07Z","date_published":"2026-10-29T11:14:07Z","id":"https://feed.craftedsignal.io/briefs/2026-10-foxit-ssrf/","summary":"A server-side request forgery (SSRF) vulnerability in the Foxit HTML-to-PDF conversion service allows bypass of internal network restrictions via crafted ZIP-formatted input.","title":"Foxit HTML-to-PDF Conversion Service: Server-Side Request Forgery (CVE-2026-111418)","url":"https://feed.craftedsignal.io/briefs/2026-10-foxit-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:foxit:html-to-Pdf_conversion_service:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}