Foxit PDF Services CVE-2026-18597

The attacker must have low-privilege authenticated access to the Foxit PDF Services API - specifically the ability to submit PDF creation requests that include external file reference URLs. The vulnerability triggers when the API's URL validation logic evaluates the initial user-supplied URL (which passes the local-file restriction check) but fails to re-validate the destination after HTTP redirect resolution. Exploitation is limited by: (1) requiring at least PR:L API credentials, so anonymous internet exploitation is not possible; (2) the internal resources reachable depend entirely on the API server's network position and egress policy - environments with strict outbound firewall rules restricting the API server to only necessary external hosts will have substantially reduced exposure; (3) IMDSv2 enforcement on AWS (which requires a PUT request to obtain a session token before GET metadata requests) blocks the cloud-metadata variant of this attack. Exploitation does not require any non-default configuration of the vulnerable product itself - the PDF external file reference feature is part of the standard API offering.

The CVSS 8.5 score reflects a Changed scope (S:C) and High confidentiality impact (C:H), which is consistent with SSRF reaching internal services. Attack complexity is Low (AC:L), meaning no race conditions or special timing is needed - a single crafted API request suffices. Low privilege (PR:L) limits unauthenticated exploitation but any user or tenant with API access is a potential threat actor, which in SaaS or multi-tenant API deployments could be a broad population. EPSS data is absent from the provided intelligence, so probabilistic exploitation likelihood cannot be quantified. KEV status is negative and no POC is known, suggesting no confirmed active exploitation. The I:L (low integrity impact) in the vendor vector likely reflects the ability to trigger unintended outbound requests (e.g., causing internal services to receive forged requests), not file modification. Real-world risk is elevated if the API server has network access to cloud metadata endpoints (AWS IMDSv1, Azure IMDS) or internal management interfaces. If the deployment is air-gapped or the API server has a restricted egress firewall, practical impact is substantially reduced. The wildcard CPE version range is notable - no minimum safe version has been identified from the available data.

An attacker with a valid low-privilege API account submits a PDF creation job containing an external file reference URL pointing to an attacker-controlled HTTP server. That server responds with a 302 redirect to http://169.254.169.254/latest/meta-data/iam/security-credentials/ or an internal microservice endpoint. The Foxit API follows the redirect, fetches the internal content, and returns it embedded in the generated PDF or error response, giving the attacker cloud credential material or internal service data without direct network access to those resources. No public exploit code is known, but the technique is well-understood and requires only standard HTTP infrastructure to execute.