Coupa Supplier Portal CVE-2026-111036

Exploitation requires an authenticated Coupa account with permissions to modify templates in the 'Contracts > Templates' section (reflected as PR:H); a crafted DOCX containing references to external resources must be uploaded and then processed by the server-side Aspose.Words for Java library during DOCX-to-PDF conversion, which performs the attacker-controlled fetch. Limiting factors: this is not reachable by anonymous or ordinary low-privilege users - it needs elevated template-management rights - and it depends on the document-conversion feature path being exercised; no user interaction by a victim and no non-default configuration is described as necessary beyond holding that privilege.

This is a genuine but access-gated risk, not a drive-by threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) and the official score of 8.4 (High) agree with the description: exploitation is remote and low-complexity, but requires PR:H - an authenticated account holding permissions to modify templates in 'Contracts > Templates'. That privilege requirement is the single most important mitigating signal and keeps this below critical. The impact signals are serious and internally consistent: VC:H plus SC:H (and S:C/C:H in 3.1 terms) reflect that SSRF against the conversion backend can reach internal services, cloud metadata endpoints, and local files to disclose credentials, environment variables, and configuration. No EPSS score, no KEV listing, and no PoC reference were supplied, so there is no evidence of active or at-scale exploitation; the vuln.today decision label is 'this_week', indicating prompt-but-not-emergency prioritization. No key signals conflict with each other, but several are simply absent (EPSS, KEV, PoC), so risk here rests on the vendor/INCIBE description and the CVSS vector rather than on observed exploitation telemetry.

An attacker who already holds a Coupa account with template-modification rights crafts a DOCX containing references to external resources (e.g. remote URLs or local file paths) and uploads it as a contract template. When the server converts the DOCX to PDF via the Aspose.Words for Java library, it fetches those references, allowing the attacker to reach internal network services or read local files and exfiltrate sensitive data such as credentials or environment variables. No public exploit identified at time of analysis.