CVE-2026-5936 is a high severity flaw (CVSS 8.5) in the Foxit PDF Services API. A crafted URL makes the server send requests to arbitrary destinations, which can probe internal services or reach cloud metadata. The record lists no versions, so check the Foxit bulletin.
What's affected
- Foxit PDF Services API. The record lists no versions.
- Fix: not stated in the record. The Foxit security bulletins page is the place to check.
How to check if you're exposed
If you call a hosted Foxit service, check the Foxit bulletin for whether customer action is needed. If you run it yourself, read the version and compare it with the bulletin. Also review which internal addresses the service can reach.
Cloud service CVEs are not something a dependency scan can find, but the Gold directory keeps the CVE record and weakness class in one place for your change ticket.
What to do now
- Read the Foxit security bulletin for this CVE.
- Apply the fix or version it names.
- Block the service from reaching internal ranges and cloud metadata addresses.
- Require the metadata service version that needs a session token, where your cloud supports it.
Write down what you checked and when. For a managed service the record is part of how you show later that you read the advisory, decided whether it applied, and acted on the result.
Why it matters
This is CWE-918 (Server-Side Request Forgery). The server fetches a URL chosen by the caller without limiting where it can go. The record says this may expose internal services, metadata endpoints and bypass network controls, with possible information disclosure.
The record scores it as needing a low privilege login. The CISA KEV flag is false.
Cloud metadata services are the best known SSRF target because a single request to a well known internal address can return credentials. Limiting what the service can reach on the network is therefore a control you can apply today, with or without a vendor fix.
Quick check
Why are cloud metadata addresses mentioned?
Requests from a server can reach metadata services that hand out credentials, which is a common SSRF goal.
Sources
Last reviewed: 19 October 2026.
