CVE-2026-110718

Deferred Deferred - Pending Action

Server-Side Request Forgery in TurboDocx html-to-docx

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying HTML to make the server fetch internal URLs via img src attributes. Attackers can reference loopback, private, or cloud metadata addresses that bypass the loose isValidUrl() check, and read responses embedded in the generated DOCX word/media folder.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110718

EUVD

EUVD-2026-101141

Affected Vendors & Products

Vendor	Product	Version / Range
TurboDocx	html-to-docx	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in TurboDocx html-to-docx through version 1.23.1. It allows attackers to supply HTML with malicious img src attributes that trick the server into fetching internal URLs, including loopback, private, or cloud metadata addresses. The vulnerability bypasses the loose URL validation and enables unauthorized access to internal resources, which are then embedded in the generated DOCX file under the word/media folder.

Detection Guidance

To detect this SSRF vulnerability in TurboDocx html-to-docx, monitor network traffic for outbound requests from the application to internal or unexpected addresses. Check logs for img src attributes referencing loopback, private, or metadata endpoints. Use tools like curl to test if the application fetches URLs like http://localhost, http://169.254.169.254, or http://metadata.google.internal.

Impact Analysis

An attacker could exploit this to access sensitive internal services, read local files, or retrieve cloud metadata, potentially exposing confidential data. If your application processes untrusted HTML and returns generated DOCX files, attackers could extract internal information through the DOCX output.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using affected versions may face compliance breaches, legal penalties, and reputational damage due to potential data exposure.

Mitigation Strategies

Immediately upgrade to the latest version of html-to-docx beyond 1.23.1 if available. Disable remote image fetching in the library configuration. Implement strict URL validation to block internal, loopback, and private IP addresses. Add network-level restrictions to prevent outbound connections to sensitive ranges.

Hi! I’m here to help you understand CVE-2026-110718. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70