---
id: CVE-2026-110718
title: >-
  TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery
  vulnerability that allows attackers supplying HTML to make the server fetch
  internal URLs via img src attributes
summary: >-
  TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery
  vulnerability that allows attackers supplying HTML to make the server fetch
  internal URLs via img src attributes. Attackers can reference loopback,
  private, or …
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-918
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T16:17:44.047'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-110718'
references:
  - url: 'https://github.com/TurboDocx/html-to-docx'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/TurboDocx/html-to-docx/blob/ff08e5687a2c87bcdc182a2e3e130c3493b9fb7e/src/utils/image.js#L286
    label: disclosure@vulncheck.com
  - url: 'https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/H1t1Bbpjfx'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/turbodocx-html-to-docx-through-1.23.1-ssrf-via-img-src-remote-image-download
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-14T16:40:32.123Z'
---

## Overview

TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying HTML to make the server fetch internal URLs via img src attributes. Attackers can reference loopback, private, or cloud metadata addresses that bypass the loose isValidUrl() check, and read responses embedded in the generated DOCX word/media folder.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.