CVE-2026-111036
Received Received - Intake

SSRF in Coupa Supplier Portal via Aspose.Words DOCX Conversion

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description
Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functionality available in the ‘Contracts > Templates’ section. The vulnerability is due to insufficient validation of references to external resources processed by the Aspose.Words for Java library during DOCX-to-PDF conversion. An authenticated attacker with permissions to modify templates could upload a specially crafted DOCX document containing references to external resources, which would cause the server-side application to access URLs controlled by the attacker, resources on the internal network, or local files. A successful exploit could lead to the disclosure of sensitive information, such as configuration files, system files, credentials, environment variables and endpoints for internal services.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-111036
EUVD
EUVD-2026-116820

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Coupa Coupa Total Spend Management Platform 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform. It exists in the document conversion feature under 'Contracts > Templates' where DOCX files are converted to PDF using the Aspose.Words for Java library. The issue arises from insufficient validation of external resource references in these documents. An attacker with template modification permissions can upload a malicious DOCX file that forces the server to access attacker-controlled URLs, internal network resources, or local files during conversion.

Impact Analysis

This vulnerability could allow an attacker to access sensitive internal resources such as configuration files, system files, credentials, environment variables, and internal service endpoints. If exploited, it may lead to unauthorized information disclosure or potential further attacks against internal systems through the compromised server.

Mitigation Strategies

Disable or restrict access to the document conversion functionality in the Coupa Supplier Portal, particularly in the Contracts > Templates section. Review and update input validation for DOCX files to block external resource references. Monitor network traffic for unusual outbound requests from the application server.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111036. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...