The Foxit PDF Services API's PDF creation feature supports referencing external files. Although local file access is restricted, an attacker can exploit URL redirection to bypass these restrictions, resulting in a Server-Side Request Forgery (CWE-918) vulnerability. This SSRF flaw can cause information disclosure by making the server perform unauthorized requests. The vulnerability has a CVSS 3.1 base score of 8.5, indicating high severity with network attack vector, low attack complexity, requiring low privileges and no user interaction, and impacts confidentiality significantly with limited integrity impact and no availability impact. There is no vendor advisory or patch information available, and the product is not a cloud service.

Successful exploitation of this SSRF vulnerability can lead to unauthorized information disclosure by tricking the server into making unintended requests via URL redirection. The confidentiality impact is high, while integrity impact is low and availability is unaffected. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. No specific mitigations are provided by the vendor at this time.