7.8High
CVE-2026-91801Foxit PDF Editor/Reader RichMedia Annotation Directory Traversal Remote Code Execution Vulnerability
Description
A path traversal vulnerability exists in Foxit PDF Editor/Reader's handling of embedded PDF resources. Insufficient validation of resource file paths may allow files to be written outside their intended locations, potentially enabling arbitrary code execution.
Weakness (CWE):
CWE-22
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| Foxit Software Inc. | Foxit PDF Editor | Versions 2026.2 and earlier, Versions 14.0.7 and earlier, Versions 13.2.6 and earlier | |
| Foxit Software Inc. | Foxit PDF Reader | Versions 2026.2 and earlier | |
| foxit | pdf editor | ≤ 13.2.5.63482 | |
| foxit | pdf reader | ≤ 2026.2.0.39747 |
References and patches
- https://www.foxit.com/support/security-bulletins.html Vendor Advisory
CPE matches (NVD) (7)
cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*≤ 13.2.5.63482cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*≥ 14.0.0.33046 ≤ 14.0.7.33751cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*≥ 2023.1.0.15510 ≤ 2023.3.0.23028cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*≥ 2024.1.0.23997 ≤ 2024.4.1.27687cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*≥ 2025.1.0.27937 ≤ 2025.3.0.35737cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*≥ 2026.1.0.36452 ≤ 2026.2.0.39747cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*≤ 2026.2.0.39747