Foxit HTML-to-PDF CVE-2026-111418

Exploitation requires interacting with Foxit's hosted HTML-to-PDF conversion service specifically via its ZIP-formatted input support, which is the exact feature that bypasses the service's restriction on requests to internal IP addresses - plain non-ZIP input is restricted. Per the supplied CVSS vector (PR:N/UI:N) the request is remote, unauthenticated and needs no victim interaction. Limiting factors: the flaw lives only on Foxit's server-side SaaS (foxit.com), so it is not exploitable in any customer-deployed product; the described impact is confined to discovery/enumeration of internal resources (C:H, I:N, A:N - no write or disruption); and the EUVD record indicates it was fixed server-side before 2026-10-29, closing the window for any party other than Foxit's own infrastructure.

The input signals are mixed and, taken together, point to a LOW operational priority for virtually every third party despite the 7.5 CVSS. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) describes a network-reachable, low-complexity, unauthenticated information-disclosure flaw, which on its face looks serious. However, the affected 'product' is Foxit's own hosted HTML-to-PDF conversion service on foxit.com - a single server-side SaaS endpoint, not software that customers deploy - and the EUVD data states it was fixed server-side ('foxit.com before 2026-10-29'), i.e. the vendor remediated it on their own infrastructure as of today's date. There is no CISA KEV listing, no EPSS score was supplied, and no confirmed proof-of-concept or working exploit code is present (the sole reference is Foxit's security-bulletins index page, not an exploit). The vuln.today decision label is 'this_week', which is a routine-priority signal, NOT act_now or emergency. Net: this is a real SSRF (CWE-918) but the exposure is confined to Foxit's hosted service and the fix is already applied upstream; for organizations that merely use Foxit products there is no self-hosted component to patch and no end-user action. Treat as informational unless you operate or integrate directly with the foxit.com conversion service.

An attacker submits a ZIP-formatted payload to Foxit's public HTML-to-PDF conversion service; because ZIP input bypasses the service's filtering on internal IP addresses, the server is coerced into issuing requests to internal, non-routable addresses on Foxit's behalf, revealing which internal hosts and services respond. Exploitation is remote and, per the supplied CVSS vector (PR:N), does not require authentication, with low attack complexity. No public exploit code is identified at time of analysis - the only reference is the vendor security-bulletin page.