Vulnerability · Published Nov 4, 2026 · Assigned by INCIBE
CVE-2026-111036Multiple vulnerabilities in Coupa’s Total Spend Management Platform
High 8.4
In plain English
A high-severity server-side request forgery in Coupa Total Spend Management Platform from Coupa. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Official description
Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functionality available in the ‘Contracts > Templates’ section. The vulnerability is due to insufficient validation of references to external resources processed by the Aspose.Words for Java library during DOCX-to-PDF conversion. An authenticated attacker with permissions to modify templates could upload a specially crafted DOCX document containing references to external resources, which would cause the server-side application to access URLs controlled by the attacker, resources on the internal network, or local files. A successful exploit could lead to the disclosure of sensitive information, such as configuration files, system files, credentials, environment variables and endpoints for internal services.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Coupa | Coupa Total Spend Management Platform | 0 – before 04/11/2024 |
Weakness: CWE-918 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L