EUVD-2026-21887Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify URL-accepting API endpoint
-
DeliverySubmit request with crafted internal/metadata URL
-
ExploitServer issues forged request to target
-
ExecutionRead response with sensitive data
-
ImpactHarvest credentials / map internal services
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The prerequisite is the ability to submit a request to the Foxit PDF Services API that includes an attacker-controlled URL the server will fetch - any API operation accepting a remote resource or callback URL. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is required against the affected service. Limiting factors: the payoff depends on the backend's network position - real disclosure (e.g. cloud metadata) requires the API infrastructure to have reachable link-local/internal endpoints, and SSVC rates the attack as not automatable with only partial technical impact, making it targeted reconnaissance rather than blind mass compromise. Impact is also bounded by whatever egress filtering Foxit enforced prior to the 2026-04-07 fix. |
| Impact | The signals conflict and should be read carefully. The published CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) implies critical, unauthenticated, fully-automatable compromise, but the remaining intelligence tempers this: EPSS is 0.03% (8th percentile), CISA SSVC rates Exploitation 'none', Automatable 'no', and Technical Impact only 'partial'. The I:H and A:H components of the vendor vector are questionable for an SSRF whose described impact is information disclosure and internal reconnaissance - the realistic primary impact is confidentiality, with integrity/availability situational at best. There is no KEV listing and no public POC, so this is not an active emergency. Net: a genuinely serious SSRF worth prompt attention for API integrators, but the raw 9.8 overstates real-world risk versus the SSVC 'partial impact / not automatable / no known exploitation' framing. Because this is a hosted service, exposure is largely bounded by Foxit's own remediation rather than customer patching. |
| Exploit ScenarioDerived | An attacker submits a document-processing or URL-fetch request to the Foxit PDF Services API containing a crafted URL pointing at http://169.254.169.254/latest/meta-data/ or an internal admin endpoint. The server issues the request and returns or acts on the response, letting the attacker harvest cloud instance credentials or map internal services from a trusted network position. No authentication or user interaction is implied by the vector, though no public POC currently exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 07, 2026
Server-side request forgery in the Foxit PDF Services API (cloud offering) lets a remote attacker supply a crafted URL that the backend fetches, coercing the server into making requests to attacker-chosen internal or external destinations. Because the service processes documents and URLs on behalf of clients, this can be abused to reach cloud metadata endpoints, internal-only services, and network zones normally shielded from the public internet, potentially disclosing credentials or sensitive data. No public exploit identified at time of analysis, and EPSS is very low (0.03%, 8th percentile), consistent with CISA SSVC scoring exploitation as 'none'.
Earlier versions of this analysis (1)
Server-Side Request Forgery (SSRF) in Foxit PDF Services API allows low-privileged remote attackers to force the server to make HTTP requests to arbitrary destinations, including internal network services and cloud metadata endpoints. With a CVSS score of 8.5 and changed scope (S:C), authenticated attackers can leverage this to probe internal infrastructure, access restricted resources like AWS/Azure metadata services (169.254.169.254), and exfiltrate sensitive information including credentials and configuration data. No public exploit identified at time of analysis, though SSRF exploitation techniques are well-documented and the low attack complexity (AC:L) makes this readily exploitable once an attacker obtains valid credentials.
RemediationAI
Because this is a Foxit-hosted cloud API, the fix was applied server-side by Foxit as of 2026-04-07 (Patch available per vendor advisory; no exact tagged version is published for a SaaS endpoint), so consumers on the live service are covered without action - confirm against Foxit's security bulletins at https://www.foxit.com/support/security-bulletins.html. Organizations that proxy or self-relay calls to this API should still add egress controls as defense-in-depth: restrict the integration's outbound path so it cannot reach cloud metadata IPs (block 169.254.169.254) and internal RFC1918 ranges, and validate/allow-list any user-supplied URLs before forwarding, accepting that legitimate internal-resource fetches will then be blocked. If you operate any on-prem or cached deployment tied to this API, verify it post-dates the 2026-04-07 fix. Review VulDB (https://vuldb.com/vuln/357097) and the NVD entry for updated version detail.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a CWE-918 (Server-Side Request Forgery) weakness in a document-processing web API. Foxit PDF Services API is a hosted/cloud service that renders and manipulates PDFs, and such services routinely fetch remote resources (images, remote documents, callback/webhook URLs) by URL - the exact functionality that enables SSRF when the destination is not validated against an allow-list. The affected component per CPE is cpe:2.3:a:foxit_software_inc.:foxit_pdf_services_api, a server-side API rather than an installable desktop client, so the vulnerable code and its fix reside on Foxit's infrastructure. The root cause is user-controlled input flowing into a server-side HTTP client without egress filtering, allowing requests to target link-local metadata IPs (e.g. 169.254.169.254) or RFC1918 internal ranges.
Know when Foxit Pdf Services Api gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network SSRF (AV:N/AC:L/PR:N/UI:N) reaching other systems justifies S:C; primary impact is confidentiality (C:H), with limited integrity via forged requests (I:L) and no real availability impact (A:N).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
An attacker can control a server-side HTTP request by supplying a crafted URL, causing the server to initiate requests to arbitrary destinations. This behavior may be exploited to probe internal network services, access otherwise unreachable endpoints (e.g., cloud metadata services), or bypass network access controls, potentially leading to sensitive information disclosure and further compromise of the internal environment.
Executive ViewAI
The Foxit PDF Services API cloud offering contains a server-side request forgery vulnerability (CVSS 9.8) that could enable attackers to abuse the service to access internal networks, cloud metadata endpoints, and sensitive systems normally shielded from public access. Organizations using this service face potential exposure of cloud credentials, internal service data, and network reconnaissance attacks. With no vendor patch available, immediate mitigation through network segmentation and API usage restrictions is critical.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Network segmentation-isolate Foxit service to dedicated VPC/security zone with restrictive egress rules; (2) Disable or strictly allowlist outbound HTTP/HTTPS destinations from the service; (3) Block access to cloud metadata endpoints (AWS 169.254.169.254, Azure 169.254.169.254, GCP metadata.google.internal) at the network layer; (4) Implement WAF rules to detect and block suspicious URL patterns in API requests; (5) Enable comprehensive request/response logging and alerting for anomalous API usage; (6) Reduce service exposure by disabling or restricting API access if not actively required for business operations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB