A server-side request forgery vulnerability in the Foxit PDF Services API allows authenticated attackers to perform unauthorized requests to external files, potentially exposing sensitive data.

This is a Server-Side Request Forgery (CWE-918) vulnerability. It occurs during the PDF creation process when the service processes external file references, and it requires the attacker to be authenticated.

The vulnerability is rated with a CVSS score of 8.5, reflecting its potential for significant impact on data confidentiality. An authenticated attacker could potentially use this service to force the application to fetch content from unauthorized locations or internal resources, leading to data exfiltration or internal network mapping.

Immediate Action: Update the Foxit PDF Services API to the version released on or after 2026-07-27 to address the identified SSRF flaw.

Proactive Monitoring: Audit logs for the PDF conversion service to identify anomalous file reference requests or attempts to access internal URLs.

Compensating Controls: Ensure the application is deployed in an environment with strict egress filtering to limit the destinations the service can communicate with.

Public Exploit Available: No

Organizations should ensure they have updated their Foxit PDF Services API to the July 2026 patch level. Given the nature of SSRF, restricting the server's network access remains a vital defense-in-depth measure.