Foxit Workspace affected by two SSRF flaws and a stored XSS (CVE-2026-119431 to CVE-2026-119433), reported by Rapid7
CERT-FR published advisory CERTFR-2026-AVI-1478 on 6 November 2026 relaying a Foxit security bulletin of the same date covering multiple vulnerabilities in Foxit products. The flaws allow server-side request forgery (SSRF) and stored cross-site scripting (XSS), and CERT-FR notes that no user interaction is required for Foxit Workspace. Three identifiers are referenced: CVE-2026-119431, CVE-2026-119432 and CVE-2026-119433, all published on 6 November 2026 and credited to Rapid7 as reporter (vulners.com). The advisory reports no exploitation in the wild and no public exploit code. Foxit directs customers to its security bulletins page for the fixes; as Workspace is a hosted collaboration service, remediation is largely vendor-side.
Entenda a falha
A vulnerabilidade
Foxit Workspace has three flaws, published 6 November 2026 and credited to Rapid7. The most severe is CVE-2026-119432, a stored XSS in the file share preview feature that can lead to credential theft and session hijacking (CVSS 3.1 8.7 reported). CVE-2026-119431 is an SSRF in the file-upload functionality that gives access to internal resources (7.7). CVE-2026-119433 is an SSRF in an undocumented API endpoint that lets a remote attacker make the server request internal resources (6.1). CERT-FR notes that no user action is required for Workspace. Affected and fixed versions are not published in the sources; the fixes are referenced in the Foxit bulletin.
Como funciona
In the two SSRF cases, a remote attacker supplies URL or network parameters to the file-upload function or to the undocumented API endpoint. The server then issues the request itself, so it can reach internal resources that the attacker could not reach directly. In the XSS case, content placed in a shared file is stored and later rendered by the file share preview feature. Script embedded in that content then runs in the browser of whoever views the preview, in the context of the Workspace session. The sources do not give finer step-by-step detail.
Por que é vulnerável
For CVE-2026-119433 the story points to insufficient validation of user-supplied URL and network parameters, so the server trusts destinations it should restrict. The SSRF in file upload is described as giving access to internal resources, which implies the same kind of missing restriction on server-side requests, though the sources do not state the root cause. The stored XSS is consistent with content in the share preview not being properly sanitized or encoded before display, but the sources do not say so explicitly. The articles do not explain why the flaws went unnoticed or what exactly the fixes change.
Onde está
The sources name only product features, not code: the file-upload functionality, an undocumented API endpoint and the file share preview feature of Foxit Workspace.
Como foi descoberta
The three CVEs are credited to Rapid7 as reporter, per vulners.com. The articles do not say how Rapid7 found the flaws or when it reported them. Foxit published a security bulletin on 6 November 2026, and CERT-FR relayed it the same day in advisory CERTFR-2026-AVI-1478. The story reports no exploitation in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 08/11/2026 11:23.
Detalhes técnicos
CVE-2026-119431 is an SSRF in the file-upload functionality of Foxit Workspace, giving access to internal resources, with a CVSS 3.1 score of 7.7 reported (vulners.com). CVE-2026-119433 is an SSRF in an undocumented API endpoint caused by insufficient validation of user-supplied URL and network parameters, allowing a remote attacker to make the server issue requests to internal resources, scored 6.1 (vulners.com, vuldb.com). CVE-2026-119432 is a stored XSS in the file share preview feature, which can lead to credential theft and session hijacking, with a CVSS 3.1 score of 8.7 reported (vulners.com, vuldb.com). The CERT-FR advisory does not list affected build numbers, and no fixed version identifiers are published in the sources consulted.
Remediação
Apply the fixes referenced in the Foxit security bulletin of 6 November 2026 (foxitsoftware.com/support/security-bulletins.php). For self-managed components, restrict outbound network access from servers that fetch user-supplied URLs to limit SSRF reach toward internal services and cloud metadata endpoints, and review shared-file preview activity for injected scripts and anomalous session use.
Linha do tempo
-
Foxit Workspace affected by two SSRF flaws and a stored XSS (CVE-2026-119431 to CVE-2026-119433), reported by Rapid7
ler a análise desta fonte ocultar
CERT-FR published advisory CERTFR-2026-AVI-1478 on 6 November 2026 relaying a Foxit security bulletin of the same date covering multiple vulnerabilities in Foxit products. The flaws allow server-side request forgery (SSRF) and stored cross-site scripting (XSS), and CERT-FR notes that no user interaction is required for Foxit Workspace. Three identifiers are referenced: CVE-2026-119431, CVE-2026-119432 and CVE-2026-119433, all published on 6 November 2026 and credited to Rapid7 as reporter (vulners.com). The advisory reports no exploitation in the wild and no public exploit code. Foxit directs customers to its security bulletins page for the fixes; as Workspace is a hosted collaboration service, remediation is largely vendor-side.
Technical Details
CVE-2026-119431 is an SSRF in the file-upload functionality of Foxit Workspace, giving access to internal resources, with a CVSS 3.1 score of 7.7 reported (vulners.com). CVE-2026-119433 is an SSRF in an undocumented API endpoint caused by insufficient validation of user-supplied URL and network parameters, allowing a remote attacker to make the server issue requests to internal resources, scored 6.1 (vulners.com, vuldb.com). CVE-2026-119432 is a stored XSS in the file share preview feature, which can lead to credential theft and session hijacking, with a CVSS 3.1 score of 8.7 reported (vulners.com, vuldb.com). The CERT-FR advisory does not list affected build numbers, and no fixed version identifiers are published in the sources consulted.
Remediation
Apply the fixes referenced in the Foxit security bulletin of 6 November 2026 (foxitsoftware.com/support/security-bulletins.php). For self-managed components, restrict outbound network access from servers that fetch user-supplied URLs to limit SSRF reach toward internal services and cloud metadata endpoints, and review shared-file preview activity for injected scripts and anomalous session use.