The Foxit PDF Services API is vulnerable to a Server-Side Request Forgery flaw that enables attackers to probe internal network infrastructure and bypass access controls.

This is a Server-Side Request Forgery (CWE-918) vulnerability where an authenticated attacker can manipulate server-side HTTP requests by providing a malicious URL. The application fails to properly validate the destination, allowing the server to act as a proxy for unauthorized requests.

This vulnerability poses a significant risk to internal network security. By exploiting this flaw, an attacker could probe private network services, access cloud metadata endpoints, or bypass perimeter firewalls, leading to potential data exfiltration or escalation of privilege within the internal environment. With a CVSS score of 8.5, this high-severity vulnerability requires immediate attention to prevent unauthorized access to sensitive internal resources.

Immediate Action: Update the Foxit PDF Services API to the version released on or after 2026-04-07 as specified in the official vendor security bulletin.

Proactive Monitoring: Review web server and application logs for anomalous outbound HTTP requests or patterns indicative of scanning behavior directed at internal IP addresses.

Compensating Controls: Implement strict egress filtering on the server hosting the API to restrict outbound connections to only necessary and trusted external endpoints.

Public Exploit Available: exploit_available (unknown)

The risk associated with this SSRF vulnerability is substantial given the potential for lateral movement within the network. Security administrators should prioritize the application of the vendor-provided security update immediately. If patching cannot be performed instantly, ensure that restrictive egress rules are in place to prevent the application from making arbitrary requests to sensitive internal infrastructure.