CVE-2026-110718 Details
Description
TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying HTML to make the server fetch internal URLs via img src attributes. Attackers can reference loopback, private, or cloud metadata addresses that bypass the loose isValidUrl() check, and read responses embedded in the generated DOCX word/media folder.
A server-side request forgery (SSRF) vulnerability has been identified in TurboDocx html-to-docx, affecting versions through 1.23.1. This vulnerability allows attackers to exploit the HTML-to-DOCX conversion process by embedding images with sources that point to internal URLs. The server fetches these URLs, bypassing the application's URL validation, and the responses are then embedded in the generated DOCX file. This could potentially expose sensitive internal data or metadata.
Integrators should be allowed to disable remote image fetching and provide a safe default for untrusted input. Additionally, the URL validation should be improved to reject loopback, private, link-local, and cloud-metadata addresses.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| TurboDocx html-to-docx | <= 1.23.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |