Server-Side Request Forgery Vulnerability in Coupa Supplier Portal by Coupa
CVE-2026-111036

8.4HIGH

Key Information:

Vendor

Coupa

Status
Coupa Total Spend Management Platform
Vendor
CVE Published:
4 November 2026

What is CVE-2026-111036?

A server-side request forgery (SSRF) vulnerability exists in the Coupa Supplier Portal, specifically within the document conversion feature in the 'Contracts > Templates' section. This weakness arises from inadequate validation of external resource references processed by the Aspose.Words for Java library during the conversion from DOCX to PDF. An attacker with proper permissions could upload a maliciously crafted DOCX file that references external resources, compelling the server-side application to access URLs directed by the attacker. This could potentially lead to the disclosure of sensitive data, including configuration files, system files, credentials, environment variables, and endpoints associated with internal services.

Affected Version(s)

Coupa Total Spend Management Platform 0 < 04/11/2024

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multip...

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

David Sacristán Manzanares
.