CVE-2026-111036
Multiple vulnerabilities in Coupa’s Total Spend Management Platform
Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functionality available in the ‘Contracts > Templates’ section. The vulnerability is due to insufficient validation of references to external resources processed by the Aspose.Words for Java library during DOCX-to-PDF conversion. An authenticated attacker with permissions to modify templates could upload a specially crafted DOCX document containing references to external resources, which would cause the server-side application to access URLs controlled by the attacker, resources on the internal network, or local files. A successful exploit could lead to the disclosure of sensitive information, such as configuration files, system files, credentials, environment variables and endpoints for internal services.
| CWE | CWE-918 |
| Vendor | coupa |
| Product | coupa total spend management platform |
| Published | Nov 4, 2026 |
| Last Updated | Nov 4, 2026 |
Get instant alerts for coupa coupa total spend management platform
Be the first to know when new unknown vulnerabilities affecting coupa coupa total spend management platform are published — delivered to Slack, Telegram or Discord.