Foxit Workspace: SSRF in file upload and PDF export plus stored XSS in file share preview (CVE-2026-119431, CVE-2026-119433, CVE-2026-119432) ยท updates https://pwn.watch/i/foxit-workspace-ssrf-xss-cve-2026-119431 On Nov 6 2026 Foxit updated its hosted Foxit Workspace service (https://ai.foxit.com/) for three Important issues. CVE-2026-119431 and CVE-2026-119433 are server-side request forgery flaws in the file-upload and PDF-export flows: insufficient validation of user-supplied URLs and network parameters could let an authenticated attacker make the service fetch arbitrary internal or external resources and return their contents (CVSS 3.0 7.7). CVE-2026-119432 is a stored cross-site scripting bug in file share preview: an attacker could upload a crafted file, share it, and when a victim opens or previews it the script runs in the application origin and may access locally stored credentials (CVSS 3.0 8.7). Foxit rates all three Important and says no customer action is required; the hosted service is already patched. Reported by mrfathoni. en Fri, 06 Nov 2026 00:00:00 GMT Foxit Workspace: SSRF in file upload and PDF export plus stored XSS in file share preview (CVE-2026-119431, CVE-2026-119433, CVE-2026-119432): Foxit publishes a Foxit Workspace security update fixing SSRF in file-upload (CVE-2026-119431) and PDF-export (CVE-2026-119433) and stored XSS in file share preview (CVE-2026-119432); no customer action required. https://pwn.watch/i/foxit-workspace-ssrf-xss-cve-2026-119431 https://pwn.watch/i/foxit-workspace-ssrf-xss-cve-2026-119431#2026-11-06-474c6fbd Fri, 06 Nov 2026 00:00:00 GMT high <p><a href="https://www.foxit.com/support/security-bulletins.html">Source</a></p>