Multiple vulnerabilities in Coupa’s Total Spend Management Platform
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 04/11/2024
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Affects the Coupa Supplier Portal SaaS platform, specifically the document conversion functionality in the 'Contracts > Templates' section. Involves DOCX-to-PDF conversion performed by the Aspose.Words for Java library with insufficient validation of external resource references.
- Exploitation?/40Exploitation: unknown (data gap). No CISA SSVC exploitation rating yet
- Exposure8/25Specific setups only, reachable over the network
- Reach?/20Reach: unknown (data gap). No tracked technology or package matched
- Severity8.4/10CVSS 8.4
- No patch0/5No signal
What would change the score
- Would score about 66 if added to CISA KEV
- Would score about 61 if CISA's SSVC rates exploitation active
- Would score about 23 if CISA's SSVC rates it automatable
CVE-2026-111036 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.4 (high) and affects Coupa Total Spend Management Platform; fixed in 04/11/2024.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- FIRST's estimate of the chance attackers exploit it in the next 30 days, updated daily.What do these mean? →
- 0.41% · 35th percentile
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 16/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 04/11/2024
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Coupa's Total Spend Management Platform, specifically its Supplier Portal document conversion feature under Contracts > Templates, has a server-side request forgery flaw that can be reached over the network by an attacker who must log in with high-level privileges to modify templates. Exploiting it could let that attacker make the server fetch attacker-chosen URLs, internal network resources, or local files, exposing sensitive information such as configuration files, credentials, and internal service endpoints.
Read the original description
Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functionality available in the ‘Contracts > Templates’ section. The vulnerability is due to insufficient validation of references to external resources processed by the Aspose.Words for Java library during DOCX-to-PDF conversion. An authenticated attacker with permissions to modify templates could upload a specially crafted DOCX document containing references to external resources, which would cause the server-side application to access URLs controlled by the attacker, resources on the internal network, or local files. A successful exploit could lead to the disclosure of sensitive information, such as configuration files, system files, credentials, environment variables and endpoints for internal services.
What to do
Check whether your setup matches what the bug needs.
Affects the Coupa Supplier Portal SaaS platform, specifically the document conversion functionality in the 'Contracts > Templates' section. Involves DOCX-to-PDF conversion performed by the Aspose.Words for Java library with insufficient validation of external resource references.Upgrade to a fixed version: 04/11/2024.
Timeline
- CVE published
- Record last updated
- First seen by cve.now
Affected versions
- Coupa Coupa Total Spend Management Platform
fixed in 04/11/2024
Evidence 1
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-111036
Is CVE-2026-111036 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
The flaw is a server-side request forgery in the DOCX-to-PDF conversion in Contracts > Templates, which uses the Aspose.Words for Java library. An attacker could make the server access attacker-controlled URLs, internal network resources, or local files, which could expose configuration files, credentials, environment variables, and internal service endpoints.Source: incibe.es
Which versions are affected by CVE-2026-111036?
Coupa Total Spend Management Platform: before 04/11/2024.Source: cve.now feed data
Am I affected, and how do I check?
The record lists Coupa Total Spend Management Platform from the first version up to the fix date of 04/11/2024. The flaw is in the document conversion feature under Contracts > Templates, so check whether that feature is in use on your Coupa instance.Source: incibe.es
How do I fix CVE-2026-111036?
Apply the update Coupa released on or after 04/11/2024. The checked facts do not name a specific fixed version, so confirm the exact update in Coupa's advisory.Source: incibe.es