{"id":"CVE-2026-111036","title":"Multiple vulnerabilities in Coupa’s Total Spend Management Platform","summary":"Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functionality available in the ‘Contracts > Templates’ section. The vulnerability is due to insufficient…","severity":"high","cvss":8.4,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L","cvssSource":"cna","cwe":["CWE-918"],"vendor":"Coupa","product":"Coupa Total Spend Management Platform","affected":["total_spend_management_platform < 04/11/2024"],"published":"2026-11-04","updated":"2026-11-04","sourceUpdated":"2026-11-04T09:36:53.318Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111036","references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-coupas-total-spend-management-platform"}],"tags":["cve.org"],"epss":0.00413,"epssPercentile":0.35805,"ingestedAt":"2026-11-05T20:33:06.725Z","slug":"CVE-2026-111036","body":"## Overview\n\nServer-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functionality available in the ‘Contracts > Templates’ section. The vulnerability is due to insufficient validation of references to external resources processed by the Aspose.Words for Java library during DOCX-to-PDF conversion. An authenticated attacker with permissions to modify templates could upload a specially crafted DOCX document containing references to external resources, which would cause the server-side application to access URLs controlled by the attacker, resources on the internal network, or local files. A successful exploit could lead to the disclosure of sensitive information, such as configuration files, system files, credentials, environment variables and endpoints for internal services.\n\n## Affected\n\n- `total_spend_management_platform < 04/11/2024`\n\n## Remediation\n\nNo solution has been reported as yet.","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":46.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}