# Foxit Workspace: SSRF in file upload and PDF export plus stored XSS in file share preview (CVE-2026-119431, CVE-2026-119433, CVE-2026-119432) · pwn.watch > On Nov 6 2026 Foxit updated its hosted Foxit Workspace service (https://ai.foxit.com/) for three Important issues. CVE-2026-119431 and CVE-2026-119433 are server-side request forgery flaws in the file-upload and PDF-export flows: insufficient validation of user-supplied URLs and network parameters could let an authenticated attacker make the service fetch arbitrary internal or external resources and return their contents (CVSS 3.0 7.7). CVE-2026-119432 is a stored cross-site scripting bug in file share preview: an attacker could upload a crafted file, share it, and when a victim opens or previews it the script runs in the application origin and may access locally stored credentials (CVSS 3.0 8.7). Foxit rates all three Important and says no customer action is required; the hosted service is already patched. Reported by mrfathoni. Page: https://pwn.watch/i/foxit-workspace-ssrf-xss-cve-2026-119431 · generated 2026-11-06T06:52:15.582Z ## Status - Severity: high · status: live · patch: patched - Product: Foxit Workspace (https://ai.foxit.com/) - Started: 2026-11-06 - CVEs: CVE-2026-119431, CVE-2026-119433, CVE-2026-119432 - Affected: Foxit Workspace (ai.foxit.com) before the Nov 6 2026 security update - Fixed in: Foxit Workspace as updated Nov 6 2026 (no customer action required) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/foxit-workspace-ssrf-xss-cve-2026-119431/feed.xml - JSON Feed: https://pwn.watch/i/foxit-workspace-ssrf-xss-cve-2026-119431/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/foxit-workspace-ssrf-xss-cve-2026-119431.json - This file: https://pwn.watch/i/foxit-workspace-ssrf-xss-cve-2026-119431/llms.txt ## Updates (newest first) - 2026-11-06: Foxit publishes a Foxit Workspace security update fixing SSRF in file-upload (CVE-2026-119431) and PDF-export (CVE-2026-119433) and stored XSS in file share preview (CVE-2026-119432); no customer action required. (https://www.foxit.com/support/security-bulletins.html) ## Fix brief # Security brief: Foxit Workspace: SSRF in file upload and PDF export plus stored XSS in file share preview (CVE-2026-119431, CVE-2026-119433, CVE-2026-119432) Source: https://pwn.watch/i/foxit-workspace-ssrf-xss-cve-2026-119431 · status: live · severity: high · updated Nov 6, 2026, 06:42 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is On Nov 6 2026 Foxit updated its hosted Foxit Workspace service (https://ai.foxit.com/) for three Important issues. CVE-2026-119431 and CVE-2026-119433 are server-side request forgery flaws in the file-upload and PDF-export flows: insufficient validation of user-supplied URLs and network parameters could let an authenticated attacker make the service fetch arbitrary internal or external resources and return their contents (CVSS 3.0 7.7). CVE-2026-119432 is a stored cross-site scripting bug in file share preview: an attacker could upload a crafted file, share it, and when a victim opens or previews it the script runs in the application origin and may access locally stored credentials (CVSS 3.0 8.7). Foxit rates all three Important and says no customer action is required; the hosted service is already patched. Reported by mrfathoni. Severity detail: Foxit Important: stored XSS CVSS 3.0 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N); two SSRFs CVSS 3.0 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). Hosted Workspace only; vendor already fixed. - Product: Foxit Workspace (https://ai.foxit.com/) - CVE / advisory ids: CVE-2026-119431, CVE-2026-119433, CVE-2026-119432 ## Affected versions - Foxit Workspace (ai.foxit.com) before the Nov 6 2026 security update ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Foxit Workspace as updated Nov 6 2026 (no customer action required) After upgrading, re-run the checks above and redeploy/restart the affected services. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes Hosted Foxit Workspace only (ai.foxit.com). Vendor fixed the service on Nov 6 2026; customers need no action. Cite Foxit security bulletins only — do not cite cve.now. Contact security-ml@foxit.com for more detail. ## Latest updates - Nov 6, 2026: Foxit publishes a Foxit Workspace security update fixing SSRF in file-upload (CVE-2026-119431) and PDF-export (CVE-2026-119433) and stored XSS in file share preview (CVE-2026-119432); no customer action required. ## Advisories - [Foxit Workspace security update (CVE-2026-119431, CVE-2026-119433, CVE-2026-119432)](https://www.foxit.com/support/security-bulletins.html) (Foxit) --- Machine-readable: https://pwn.watch/i/foxit-workspace-ssrf-xss-cve-2026-119431.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.