CVE-2025-66520

A stored cross-site scripting (XSS) vulnerability exists in the Portfolio feature of the Foxit PDF Editor cloud (pdfonline.foxit.com). User-supplied SVG files are not properly sanitized or validated before being inserted into the HTML structure. As a result, embedded HTML or JavaScript within a crafted SVG may execute whenever the Portfolio file list is rendered.

Score

CVSS 3.1 6.3 Medium

Status

Analyzed - 14984358-7092-470d-8f34-ade47a7658a2

Published

2025-12-19

Last modified

2025-12-19

Weaknesses

CWE-79

Affected products

• Pdf Editor Cloud (Foxit)
• Pdfonline.foxit.com (Foxit Software Inc.)

References

• https://www.foxit.com/support/security-bulletins.html