Dashboard / CVE-2026-111036

CVE-2026-111036

HIGH
MEDIUM Priority: 0.03 BB Relevance: 62/100
Published: 2026-11-04 Modified: 2026-11-04 First seen: 2026-11-04 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: High
UI: None
S: X
AT: None
VC: High
VI: Low
VA: Low

Description

Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functionality available in the ‘Contracts > Templates’ section. The vulnerability is due to insufficient validation of references to external resources processed by the Aspose.Words for Java library during DOCX-to-PDF conversion. An authenticated attacker with permissions to modify templates could upload a specially crafted DOCX document containing references to external resources, which would cause the server-side application to access URLs controlled by the attacker, resources on the internal network, or local files. A successful exploit could lead to the disclosure of sensitive information, such as configuration files, system files, credentials, environment variables and endpoints for internal services.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
Coupa Coupa Total Spend Management Platform 0 < 04/11/2024
Coupa Coupa Total Spend Management Platform 0 < 04/11/2024

References & Advisories (1)

Bug Bounty Relevance

62 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

8.4 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.41%
Raw Score 0.004130
Percentile 35.9%
Date 2026-11-08

EPSS Trend

2026-11-08
0.00413
2026-11-07
0.00413
2026-11-06
0.00413
2026-11-05
0.00413
2026-11-04
0.00413

Intelligence Sources

mitre ref →
nvd ref →

External Links