# CVE-2026-5936: Foxit PDF Services API SSRF via crafted URL

Source: https://junglewise.ai/threats/cve-2026-5936-foxit-pdf-services-api-ssrf-via-crafted-url  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-13. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-5936 · Severity: high · CVSS 8.5 · Published 2026-04-13

Foxit PDF Services API, a tool used by developers to automate PDF creation and manipulation, is vulnerable to a security flaw that allows attackers to redirect the server's network traffic. By providing a specially crafted web address, an attacker can force the server to connect to internal systems or cloud management services that are normally protected from the public internet. This could lead to the theft of sensitive internal data or provide a foothold for further attacks on the organization's private network.

Vendors: [Foxit](https://junglewise.ai/threats/vendors/foxit).

## Quick answers

**Is CVE-2026-5936 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5936 being exploited in the wild.

**How severe is CVE-2026-5936?** High severity, with a CVSS score of 8.5, published 13 April 2026.

**Which products and versions are affected?** Foxit Pdf Services Api before 2026-04-07.

**Is there a fix for CVE-2026-5936?** A patch was published on 2026-04-07: Service updated to address the vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-5936 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-5936?** Check whether you run Foxit Pdf Services Api at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability (CWE-918) exists in the Foxit PDF Services API. The flaw is caused by insufficient validation of user-supplied URLs, which allows an authenticated attacker to control the destination of HTTP requests initiated by the server. By submitting a crafted URL, an attacker can bypass network access controls to probe internal network services, access cloud metadata services (IMDS), or interact with otherwise unreachable internal endpoints. This can result in sensitive information disclosure or further lateral movement within the internal environment. The issue was addressed in the service update released on April 7, 2026.

## Affected products

- Foxit PDF Services API before 2026-04-07

## Timeline

- 2026-04-07: patched: Service updated to address the vulnerability.
- 2026-04-13: disclosed: Initial vulnerability disclosure.
- 2026-04-13: advisory: NVD entry published.

## References

- [https://www.foxit.com/support/security-bulletins.html](https://www.foxit.com/support/security-bulletins.html)