Security News Foxit PDF Editor Vulnerabilities Let Attackers Execute Arbitrary JavaScript

[Parkinsond]

Content source

https://cybersecuritynews.com/foxit-pdf-editor-vulnerabilities/

Security updates addressing critical cross-site scripting (XSS) vulnerabilities in Foxit PDF Editor Cloud that could allow attackers to execute arbitrary JavaScript code in users’ browsers.

The vulnerabilities were discovered in the application’s File Attachments list and Layers panel, where insufficient input validation and improper output encoding create pathways for malicious code execution.

The application fails to properly encode untrusted input before embedding it into the HTML structure, enabling arbitrary JavaScript execution within the user’s browser context.

An attacker exploiting these vulnerabilities could access sensitive information visible to the authenticated user, including document contents and session data.

Foxit has released security patches addressing both vulnerabilities as part of the February 3, 2026 update to Foxit PDF Editor Cloud.

Foxit PDF Editor Vulnerabilities Let Attackers Execute Arbitrary JavaScript

Foxit PDF Editor Cloud patches XSS flaws in File Attachments and Layers, preventing attackers from executing JavaScript in users’ browsers.

cybersecuritynews.com

 

[Zero Knowledge]

The only reason not to be using SumatraPDF is the edit and signature function on other PDFs. Otherwise not sure why you would use them.

 

[Parkinsond]

The only reason not to be using SumatraPDF is the edit and signature function on other PDFs. Otherwise not sure why you would use them.

I use PDF-XChange editor (free version) for editing; stopped using Chinese apps, regardless how good they might be for doing the job.

 

[Zero Knowledge]

PDF has been around since the start of the internet, and it still has vulnerabilities because for some reason they allow java script and external links in PDFs.

 

[Parkinsond]

PDF has been around since the start of the internet, and it still has vulnerabilities because for some reason they allow java script and external links in PDFs.

I have javascript always disabled in any pdf viewer I use, in addition to blocking its internet connectivity in FW.

 

[Divergent]

Technical Analysis & Remediation

Vulnerability Profile

CVE IDs
CVE-2026-1591
CVE-2026-1592.

Weakness
CWE-79 (Improper Neutralization of Input During Web Page Generation).

Severity
CVSS 3.0: 6.3 (Moderate).

Vector
Network (AV:N) | Complexity: Low (AC:L) | Privileges: Low (PR:L) | User Interaction: Required (UI:R).

Root Cause & Attack Path
The application fails to properly sanitize or encode user inputs located in:

Layer Names
Custom names assigned to PDF layers.

Attachment Filenames
Names of files embedded within the PDF document.

When a user views a document containing these malicious inputs, the application renders them directly into the HTML structure without encoding. This allows the attacker's JavaScript payload to execute in the context of the user's session, potentially exfiltrating sensitive document data or session tokens.

Live Evidence Anchors
"The vulnerabilities were discovered in the application’s File Attachments list and Layers panel".

"...inadequate sanitization of user inputs in layer names and attachment file names".

Remediation - THE ENTERPRISE TRACK (SANS PICERL)

Phase 1: Identification & Containment

Inventory Check
Query software asset management tools for instances of Foxit PDF Editor (Desktop) and identify users with access to Foxit PDF Editor Cloud.

Policy Enforcement
Temporarily restrict the opening of PDF files from external/untrusted sources until patch verification is complete.

Attack Surface Reduction
If immediate patching is not possible for Desktop clients, disable JavaScript execution within the PDF Editor preferences where feasible.

Phase 2: Eradication

Patch Deployment

Cloud Version
No action required; Foxit deploys updates automatically to the Cloud environment.

Desktop Version
Deploy the February 3, 2026 security update immediately via centralized patch management or the internal update mechanism.

Configuration Review
Review organization-wide security policies regarding PDF handling and restrict access to advanced editing features (like Layers) for non-essential roles.

Phase 3: Recovery

Validation
Verify the version number of installed Desktop clients against the latest release notes to ensure the patch is applied.

User Notification
Inform staff that Cloud versions have been updated and that they may see prompts to restart or reload their browser sessions.

Phase 4: Lessons Learned

Training
Incorporate this vector (malicious PDF layer/attachment names) into phishing simulations and security awareness training.

Detection
Update Email Security Gateway (ESG) rules to scrutinize PDF attachments for suspicious JavaScript or unusually long strings in metadata fields.

Remediation - THE HOME USER TRACK

Priority 1: Update Immediately

Desktop Users
Open Foxit PDF Editor, navigate to Help > Check for Updates, and install the latest version released on Feb 3, 2026.

Cloud Users
The update is automatic. Ensure you refresh your browser if you have had the tab open for an extended period.

Priority 2: Safe Habits

Verify Sources
Do not open PDF files from unknown senders, especially if they claim to contain "layers" or "attachments" you must view.

Disable JavaScript
In your PDF reader settings, consider disabling JavaScript execution if you do not strictly need it for forms or interactive documents.

Hardening & References

Vendor Advisory
Foxit Security Bulletins.

CWE Reference
CWE-79 (Cross-site Scripting).

Contact
Foxit Security Response Team (security-ml@foxit.com).

Source

Cyber Security News

Foxit Security Bulletins