CVE-2026-5936

{
  "id": "CVE-2026-5936",
  "sourceIdentifier": "14984358-7092-470d-8f34-ade47a7658a2",
  "published": "2026-04-13T07:16:50.710",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An attacker can control a server-side HTTP request by supplying a crafted URL, causing the server to initiate requests to arbitrary destinations. This behavior may be exploited to probe internal network services, access otherwise unreachable endpoints (e.g., cloud metadata services), or bypass network access controls, potentially leading to sensitive information disclosure and further compromise of the internal environment."
    },
    {
      "lang": "es",
      "value": "Un atacante puede controlar una solicitud HTTP del lado del servidor al proporcionar una URL manipulada, haciendo que el servidor inicie solicitudes a destinos arbitrarios. Este comportamiento puede ser explotado para sondear servicios de red internos, acceder a puntos finales que de otro modo serían inalcanzables (p. ej., servicios de metadatos en la nube), o eludir controles de acceso a la red, lo que podría conducir a la revelación de información sensible y a un mayor compromiso del entorno interno."
    }
  ],
  "affected": [
    {
      "source": "14984358-7092-470d-8f34-ade47a7658a2",
      "affectedData": [
        {
          "vendor": "Foxit Software Inc.",
          "product": "Foxit PDF Services API",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "before 2026-04-07",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "14984358-7092-470d-8f34-ade47a7658a2",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
          "baseScore": 8.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.7
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-13T13:50:20.644193Z",
          "id": "CVE-2026-5936",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "14984358-7092-470d-8f34-ade47a7658a2",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:foxit:pdf_services_api:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2026-04-07",
              "matchCriteriaId": "07237F4D-7EA9-4226-9456-093CEF8C2688"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.foxit.com/support/security-bulletins.html",
      "source": "14984358-7092-470d-8f34-ade47a7658a2",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}