CVE-2026-111036

Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functionality available in the ‘Contracts > Templates’ section. The vulnerability is due to insufficient validation of references to external resources processed by the Aspose.Words for Java library during DOCX-to-PDF conversion. An authenticated attacker with permissions to modify templates could upload a specially crafted DOCX document containing references to external resources, which would cause the server-side application to access URLs controlled by the attacker, resources on the internal network, or local files. A successful exploit could lead to the disclosure of sensitive information, such as configuration files, system files, credentials, environment variables and endpoints for internal services.

• CWE-918

• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-coupas-total-spend-management-platform

Published

Nov 4, 2026

Last Modified

Nov 4, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11102Inappropriate implementation in Isolated Web Apps in Google …8.8
• CVE-2026-111021The افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress…7.1
• CVE-2026-111027The Welcart e-Commerce WordPress plugin before 2.12.6 does n…6.8
• CVE-2026-11103Inappropriate implementation in Installer in Google Chrome o…7.8
• CVE-2026-111031The Welcart e-Commerce WordPress plugin before 2.12.6 does n…4.7
• CVE-2026-111032The Welcart e-Commerce WordPress plugin before 2.12.6 does n…3.8
• CVE-2026-111037A reflected Cross-Site Scripting (XSS) vulnerability in the …5.1
• CVE-2026-111038CSV formula injection vulnerability in the export functional…7.3
• CVE-2026-11104Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7…6.5
• CVE-2026-111040The platform allows persistent HTML injection into editable …5.1
• CVE-2026-111041The AI Engine WordPress plugin before 3.7.9 does not verify…4.9
• CVE-2026-111044Sunshine is a self-hosted game stream host for Moonlight. Fr…7.6