Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malicious attachments being able to be written to directories outside the expected secure area when the PDF is opened.
Fix
Patch, vendor advisory and mitigation references on NVD 1
- https://www.foxit.com/support/security-bulletins.html Vendor Advisory
Vendor advisories in the News 1
- ZDI-26-733: Foxit PDF Reader Portfolio Directory Traversal Remote Code Execution Vulnerability Zero Day Initiative: published advisories · 2026-09-23
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.8 · foxitNVD modified 2026-10-08 13:49
Affected (CPE criteria) 2
cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*
References 1
- https://www.foxit.com/support/security-bulletins.html Vendor Advisory