SSRF in Foxit Pdf Services API
CVE-2026-5936
An attacker can control a server-side HTTP request by supplying a crafted URL, causing the server to initiate requests to arbitrary destinations. This behavior may be exploited to probe internal network services, access otherwise unreachable endpoints (e.g., cloud metadata services), or bypass network access controls, potentially leading to sensitive information disclosure and further compromise of the internal environment.
Vulnerability class: SSRF (Server-Side Request Forgery)
EPSS: 0.002 (9.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N.
Affected products
- Foxit Pdf_services_api
- Foxit Software Inc. Pdf Services Api — versions before 2026-04-07
Weakness classification (CWE)
References
- 14984358-7092-470d-8f34-ade47a7658a2 (Vendor Advisory)
Frequently asked questions
- What is CVE-2026-5936?
- CVE-2026-5936 is a high-severity vulnerability in Foxit Pdf Services API, classified under Server-Side Request Forgery (SSRF). CVSS score: 8.5/10. Published 2026-04-13.
- How severe is CVE-2026-5936?
- High severity. CVSS v3 base score is 8.5 out of 10.