CVE-2026-18597: Foxit PDF Services API SSRF Vulnerability

CVE-2026-18597 Overview

CVE-2026-18597 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in the Foxit PDF Services API. The PDF creation feature supports referencing external files during document generation. While the implementation restricts local file access, an authenticated attacker can bypass this validation by leveraging URL redirection. The redirected request executes with the privileges of the PDF Services API backend, enabling the attacker to reach internal resources otherwise unreachable from the network. Successful exploitation results in information disclosure from internal services.

Critical Impact
An authenticated attacker can pivot through the Foxit PDF Services API to internal endpoints using URL redirection, exposing sensitive data from otherwise unreachable network resources.

Affected Products

Foxit PDF Services API (PDF creation feature)
Refer to the Foxit Security Bulletins for specific affected versions

Discovery Timeline

2026-08-06 - CVE-2026-18597 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-18597

Vulnerability Analysis

The Foxit PDF Services API allows callers to reference external files when generating PDF documents. To prevent local file exfiltration, the service applies input validation on the referenced URLs. This validation checks the initial target of the request but does not re-validate URLs returned through HTTP redirection.

An authenticated attacker submits a PDF creation request that references an attacker-controlled URL. The controlled endpoint responds with an HTTP redirect (3xx) pointing to an internal resource, such as a cloud metadata service or an internal management interface. The API backend follows the redirect and fetches the internal resource. The retrieved data is then embedded into the generated PDF or returned in error responses, achieving information disclosure.

The attack changes the security scope from the API context to the backend network context, which is why the impact extends beyond the vulnerable component itself.

Root Cause

The root cause is incomplete input validation on the URL processing pipeline. The service enforces access controls on the first URL supplied by the caller but does not reapply those controls to redirected destinations returned by remote servers. This trust boundary gap allows attackers to reach hosts and paths the validator would otherwise reject.

Attack Vector

Exploitation is network-based and requires low privileges (an authenticated API caller). No user interaction is needed. The attacker hosts a redirector at a public URL that returns a 302 response pointing to an internal target such as http://169.254.169.254/latest/meta-data/ on cloud infrastructure or an internal service on http://127.0.0.1. The attacker then submits a PDF creation request referencing the redirector URL. The backend follows the redirect and processes the internal response, exposing its contents.

No verified public proof-of-concept code exists for this CVE. See the Foxit Security Bulletins for vendor-provided technical details.

Detection Methods for CVE-2026-18597

Indicators of Compromise

Outbound HTTP requests from the Foxit PDF Services API backend to cloud metadata endpoints such as 169.254.169.254 or link-local addresses
API requests containing external URL references followed shortly by redirects to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8)
Generated PDFs containing content originating from internal service responses (HTML error pages, JSON metadata payloads)
Anomalous authenticated API sessions issuing repeated PDF creation requests with varying external URL parameters

Detection Strategies

Instrument the PDF creation service to log the final destination URL after redirect resolution, not just the initial input
Alert on any backend fetch where the resolved host resolves to a private, loopback, or link-local IP address
Correlate API call patterns against baseline PDF creation traffic to identify enumeration behavior across multiple external URLs

Monitoring Recommendations

Monitor egress traffic from the PDF Services API host segment for connections to internal management interfaces and cloud metadata IPs
Ingest API access logs and web proxy logs into a centralized data lake for correlation between authenticated sessions and outbound fetches
Track redirect chain depth for external URL fetches and flag chains that terminate at internal targets

How to Mitigate CVE-2026-18597

Immediate Actions Required

Apply the vendor patch referenced in the Foxit Security Bulletins as soon as it is available for your deployment
Restrict egress from the PDF Services API backend to only the external hosts required for legitimate operations
Block backend access to cloud instance metadata services using IMDSv2 enforcement or explicit deny rules
Rotate any credentials that may have been exposed through the metadata service if the API backend runs in a cloud environment

Patch Information

Foxit publishes fixes and version details through the Foxit Security Bulletins. Verify the fixed version corresponding to your Foxit PDF Services API deployment and upgrade accordingly.

Workarounds

Disable the external file reference feature in PDF creation requests if not required by your workflow
Deploy an egress proxy that resolves and validates redirect targets, rejecting any destination in private or reserved address space
Enforce an allowlist of external hostnames that the PDF Services API backend is permitted to fetch
Configure the HTTP client used by the backend to refuse to follow redirects, requiring the caller to provide the final URL

bash

# Example egress firewall rules to block SSRF pivots to internal targets
# Adjust interface and chain names for your environment
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT