---
id: CVE-2026-111036
title: Multiple vulnerabilities in Coupa’s Total Spend Management Platform
summary: >-
  Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal
  SaaS platform, specifically in the document conversion functionality available
  in the ‘Contracts > Templates’ section. The vulnerability is due to
  insufficient…
severity: high
cvss: 8.4
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L'
cvssSource: cna
cwe:
  - CWE-918
vendor: Coupa
product: Coupa Total Spend Management Platform
affected:
  - total_spend_management_platform < 04/11/2024
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T09:36:53.318Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111036'
references:
  - url: >-
      https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-coupas-total-spend-management-platform
tags:
  - cve.org
epss: 0.00413
epssPercentile: 0.35805
ingestedAt: '2026-11-05T20:33:06.725Z'
---

## Overview

Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functionality available in the ‘Contracts > Templates’ section. The vulnerability is due to insufficient validation of references to external resources processed by the Aspose.Words for Java library during DOCX-to-PDF conversion. An authenticated attacker with permissions to modify templates could upload a specially crafted DOCX document containing references to external resources, which would cause the server-side application to access URLs controlled by the attacker, resources on the internal network, or local files. A successful exploit could lead to the disclosure of sensitive information, such as configuration files, system files, credentials, environment variables and endpoints for internal services.

## Affected

- `total_spend_management_platform < 04/11/2024`

## Remediation

No solution has been reported as yet.