Executive brief
Foxit PDF Services API, a tool used by developers to automate PDF creation and manipulation, is vulnerable to a security flaw that allows attackers to redirect the server's network traffic. By providing a specially crafted web address, an attacker can force the server to connect to internal systems or cloud management services that are normally protected from the public internet. This could lead to the theft of sensitive internal data or provide a foothold for further attacks on the organization's private network.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability (CWE-918) exists in the Foxit PDF Services API. The flaw is caused by insufficient validation of user-supplied URLs, which allows an authenticated attacker to control the destination of HTTP requests initiated by the server. By submitting a crafted URL, an attacker can bypass network access controls to probe internal network services, access cloud metadata services (IMDS), or interact with otherwise unreachable internal endpoints. This can result in sensitive information disclosure or further lateral movement within the internal environment. The issue was addressed in the service update released on April 7, 2026.
Affected products
- Foxit PDF Services API before 2026-04-07
Timeline
- 2026-04-07: patched: Service updated to address the vulnerability.
- 2026-04-13: disclosed: Initial vulnerability disclosure.
- 2026-04-13: advisory: NVD entry published.