# CVE-2026-111036: Coupa Supplier Portal server-side request forgery in document conversion

Source: https://junglewise.ai/threats/cve-2026-111036-server-side-request-forgery-ssrf-vulnerability-in-the-coupa  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-111036 · Severity: info · Published 2026-11-04

The Coupa Supplier Portal is a cloud-based procurement platform used by organizations to manage supplier contracts and templates. An authenticated user with template modification permissions can upload a malicious document that tricks the server into fetching internal files, accessing the company's internal network, or revealing sensitive configuration data like passwords and API endpoints. This could expose critical business secrets and internal infrastructure details.

Technologies: [Coupa Supplier Portal](https://junglewise.ai/threats/technologies/supplier-portal). Vendors: [Coupa](https://junglewise.ai/threats/vendors/coupa).

## Quick answers

**Is CVE-2026-111036 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111036 being exploited in the wild.

**How severe is CVE-2026-111036?** Informational severity, published 4 November 2026.

**Which products and versions are affected?** Coupa Supplier Portal.

**Is there a fix for CVE-2026-111036?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-111036 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-111036?** Check whether you run Coupa Supplier Portal. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A server-side request forgery (SSRF) vulnerability exists in the document conversion functionality (DOCX-to-PDF) due to insufficient validation of external resource references processed by the Aspose.Words for Java library. An authenticated attacker with template modification permissions can craft a malicious DOCX document that causes the server to make arbitrary HTTP requests to attacker-controlled URLs, internal network resources, or local files. Successful exploitation leads to disclosure of sensitive information including configuration files, credentials, and internal service endpoints.

## Affected products

- Coupa Supplier Portal

## Timeline

- 2026-11-04: disclosed

## References

- [https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-coupas-total-spend-management-platform](https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-coupas-total-spend-management-platform)

## Related threats

- [Coupa Supplier Portal CSV formula injection in export](https://junglewise.ai/threats/cve-2026-111038-csv-formula-injection-vulnerability-in-the-export-functionality)
- [Coupa Supplier Portal reflected XSS in Tenders module](https://junglewise.ai/threats/cve-2026-111037-a-reflected-cross-site-scripting-xss-vulnerability-in-the)