The Foxit PDF Services API's PDF creation feature allows referencing external files. While local file access is restricted, an attacker can leverage URL redirection to bypass these restrictions and perform Server-Side Request Forgery (CWE-918). This SSRF vulnerability can cause information disclosure by making the server send unauthorized requests to internal or external resources. The CVSS 3.1 score is 8.5, indicating high impact with network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. No official remediation or patch information is currently available.

Successful exploitation of this SSRF vulnerability could lead to unauthorized information disclosure by causing the server to make unintended requests. The confidentiality impact is high, while integrity and availability impacts are low or none. There are no reports of active exploitation in the wild. The vulnerability requires low privileges and no user interaction, increasing the risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is provided, users should monitor vendor communications for updates. Until a patch is available, consider restricting access to the PDF Services API and carefully validating or sanitizing inputs that reference external files to reduce risk.