{"affected":[{"defaultStatus":"unaffected","product":"Coupa Total Spend Management Platform","source":"CNA: INCIBE","vendor":"Coupa","versions":[{"lessThan":"04/11/2024","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-111036","cwes":["CWE-918"],"description":"Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functionality available in the ‘Contracts > Templates’ section. The vulnerability is due to insufficient validation of references to external resources processed by the Aspose.Words for Java library during DOCX-to-PDF conversion. An authenticated attacker with permissions to modify templates could upload a specially crafted DOCX document containing references to external resources, which would cause the server-side application to access URLs controlled by the attacker, resources on the internal network, or local files. A successful exploit could lead to the disclosure of sensitive information, such as configuration files, system files, credentials, environment variables and endpoints for internal services.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.4,"severity":"high","source":"CNA: INCIBE","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L","version":"4.0"},{"score":8.4,"severity":"high","source":"NVD: cve-coordination@incibe.es","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"}],"modifiedAt":1793787444770,"publishedAt":1793784591856,"references":[{"source":"CNA: INCIBE","tags":[],"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-coupas-total-spend-management-platform"},{"source":"cve-coordination@incibe.es","tags":[],"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-coupas-total-spend-management-platform"}],"remediation":[{"kind":"fix","source":"CNA: INCIBE","text":"No solution has been reported as yet."}],"revision":"efd28a1a82a6b5c119bb729f4c46bd1ea81344139c385cc701606d3550e9bbea","sources":[{"modifiedAt":1793785013318,"name":"CNA: INCIBE","retrievedAt":1793786908710,"url":"https://www.cve.org/CVERecord?id=CVE-2026-111036"},{"modifiedAt":1793787444770,"name":"NVD","retrievedAt":1793794571239,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111036"}],"ssvc":null,"status":"published","title":"Multiple vulnerabilities in Coupa’s Total Spend Management Platform","updatedAt":1793794571239}