TurboDocx CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH TurboDocx CVE published 2026-10-14

CVE-2026-110718

CVE-2026-110718 is a server-side request forgery vulnerability in TurboDocx html-to-docx through version 1.23.1. The vulnerability allows attackers to make the server fetch internal URLs via img src attributes, potentially bypassing the isValidUrl() check. This could lead to unauthorized access to internal resources or metadata. Defenders should assess the vulnerability's impact and apply necessary patche [truncated]