Coupa contract templates can be turned against the server, INCIBE says

Coupa contract templates can be turned against the server, INCIBE says

4 November 2026: Spain's INCIBE-CERT has coordinated four flaws in Coupa's Supplier Portal, led by CVE-2026-111036, a server-side request forgery rated 8.4 on CVSS v4.0 that lets a user able to edit contract templates make Coupa's servers fetch attacker-chosen addresses. INCIBE reports no fix so far and no exploitation of any of the four.

Not yet independently verified. We have not seen an advisory from Coupa, so fix status rests on INCIBE-CERT saying no solution has been reported. We do not know whether the hosted service has been corrected on the server side. We will update this when it can be confirmed, and remove this note.

How a DOCX template reaches internal systems

The top flaw sits in the conversion of contract templates from DOCX to PDF, which uses Aspose.Words for Java. A Word file can refer to outside resources, and the conversion follows those references. An authenticated user with rights to change templates can therefore point the server at internal resources or local files, which could expose configuration files, credentials and environment variables.

This one needs a login with template rights, so the first question for a customer is how many people hold them, including any outside consultants.

The other three flaws

• CVE-2026-111038, CVSS v4.0 7.3: formula injection in the CSV export, where event names or templates in the tenders module are not neutralised
• CVE-2026-111037, CVSS v4.0 5.1: reflected cross-site scripting through the list_item_function parameter in the tenders module
• CVE-2026-111040, CVSS v4.0 5.1: stored HTML injection in fields managed by the TinyMCE editor

The second of these is the one most likely to reach people who never log into Coupa. An event name holding a formula can land in a spreadsheet that a buyer opens on a work laptop, and it then runs in that buyer's own context. INCIBE credits the discoveries to David Sacristan Manzanares.

What customers can do without a patch

Coupa is delivered as a hosted service, so a customer cannot install a fix even when one exists. That leaves three things within reach: reviewing who can edit contract templates and cutting the list, warning staff who export tender data to open those files with care, and asking the account team in writing whether these four CVEs are fixed on their instance and when.

The written answer matters for anyone whose supplier risk process tracks open vendor flaws, since the public notice alone leaves that question unanswered. Our procurement software category lists five products for buyers comparing how vendors handle such disclosures.

Related on TrustList:

• Docusign buys Suplari to read procurement spend against contracts
• Only 2 of 47 software deals we covered addressed customer contracts
• MARC raises $5m seed to check real estate invoices against contracts

Sources

• INCIBE-CERT: Multiple vulnerabilities in Coupa Total Spend Management Platform, INCIBE-2026-836, 4 November 2026, 4 November 2026