CVE-2026-110718: Server-Side Request Forgery (SSRF) in TurboDocx html-to-docx
Description
TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying HTML to make the server fetch internal URLs via img src attributes. Attackers can reference loopback, private, or cloud metadata addresses that bypass the loose isValidUrl() check, and read responses embedded in the generated DOCX word/media folder.
CVSS v4.0
Score 8.2high
Affected software
TurboDocx
html-to-docx
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-110718 is a server-side request forgery vulnerability in TurboDocx html-to-docx through version 1.23.1. Attackers can craft HTML input containing img src attributes that trigger the server to make HTTP requests to internal or cloud metadata endpoints. The vulnerability exists due to a weak URL validation function (isValidUrl()) that fails to block loopback and private IP addresses. As a result, the server fetches these internal resources and embeds their responses into the generated DOCX document, potentially leaking sensitive internal information.
Potential Impact
An attacker can cause the vulnerable server to make unauthorized HTTP requests to internal network resources or cloud metadata services. This can lead to disclosure of sensitive internal data embedded in the generated DOCX files. The vulnerability does not require user interaction or privileges and has a high severity score (CVSS 8.2). There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted HTML input with TurboDocx html-to-docx or implement strict URL validation to block internal and loopback addresses in img src attributes.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-14T14:39:54.095Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acfa0f92cdf04f65690568c
Added to database: 10/14/2026, 15:34:17 UTC
Last enriched: 10/14/2026, 15:49:16 UTC
Last updated: 10/14/2026, 20:49:11 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.