SSRF via URL Redirection in Foxit PDF Services API

The PDF creation feature of Foxit PDF Services API supports referencing external files. Although local file access is restricted, an attacker could trigger an SSRF vulnerability by using URL redirection to bypass validation, leading to information disclosure.

Casky was already ahead

This CVE exploits attack patterns that Casky's 331matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-18597 is a Server-Side Request Forgery (SSRF) vulnerability in Foxit PDF Services API that exploits the platform's external file referencing feature in PDF creation. While the API implements restrictions on local file access, attackers can bypass these controls using URL redirection techniques to make the server perform unintended requests. This vulnerability carries a CVSS score of 8.5 and can lead to information disclosure, potentially exposing sensitive internal resources, metadata, or configuration details that should not be accessible. Organizations using Foxit PDF Services for document processing—particularly those handling sensitive data or operating in regulated environments—face risk if they process untrusted PDF creation requests without additional controls.

Casky's 331 matching skills, powered by Claude AI's extended reasoning capabilities, detect the attack patterns underlying this vulnerability by analyzing MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0006 (Resource Development). Practitioners using Casky would observe findings that correlate suspicious PDF creation requests containing URL redirection payloads with outbound requests to unexpected internal endpoints or cloud metadata services. The skills identify behavioral indicators such as: external file references pointing to redirect URLs, patterns of failed local file access attempts followed by successful redirected requests, and reconnaissance-style queries targeting internal IP ranges or service discovery endpoints. By mapping these indicators against CWE-918 validation bypass patterns, Casky helps teams distinguish between legitimate PDF generation activities and weaponized requests designed to probe internal infrastructure.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

331 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-18597.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0006

Investigate the attack patterns behind CVE-2026-18597

Casky has 331 skills that investigate the attack patterns behind CVE-2026-18597. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn