CVE-2026-119431

Overview

CVE-2026-119431 is a high-severity server-side request forgery (SSRF) vulnerability in Foxit Workspace's file-upload feature. Insufficient validation of user-supplied links allows remote attackers to force the server to access internal resources, potentially exposing sensitive data or internal services.

Description

A server-side request forgery (SSRF) vulnerability exists in Foxit Workspace's file-upload functionality. Insufficient validation of user-supplied links may allow a remote attacker to induce the server to access internal resources and return their contents, potentially resulting in sensitive information disclosure and unauthorized access to internal services.

Impact

Confidentiality is primarily at risk, as attackers may retrieve internal resource contents. Integrity and availability could be indirectly affected if internal services are manipulated or overwhelmed. Remote, unauthenticated attackers are the primary threat actors. Organizations using Foxit Workspace for internal collaboration or file sharing are most exposed.

Remediation

Apply the latest security patch from Foxit immediately. Restrict outbound network traffic from the Foxit Workspace server to only necessary external destinations. Implement strict input validation and allowlisting for URLs in file-upload fields. Monitor server logs for unusual internal resource access patterns.

Risk context

With a CVSS v3 score of 7.7 (High), this vulnerability poses a significant risk, especially in environments where Foxit Workspace is accessible from untrusted networks. No EPSS score is available, but the high severity and remote exploitability warrant prompt remediation.

Affected products

• Foxit Workspace