CVE-2026-18597 — Blind SSRF on Foxit PDF Services API

CVE-2026-18597

Blind SSRF on Foxit PDF Services API PUBLISHED

Description (CNA)

The PDF creation feature of Foxit PDF Services API supports referencing external files. Although local file access is restricted, an attacker could trigger an SSRF vulnerability by using URL redirection to bypass validation, leading to information disclosure.

Affected (CNA)

Vendor / product	Versions
Foxit Software Inc. / Foxit PDF Services API	affected before 2026-07-27

CWE

CWE-918

References

https://www.foxit.com/support/security-bulletins.html

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.