CVE-2026-91797

Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malicious attachments being able to be written to directories outside the expected secure area when the PDF is opened.

Score

CVSS 3.1 7.8 High

Status

Analyzed - 14984358-7092-470d-8f34-ade47a7658a2

Published

2026-09-23

Last modified

2026-10-08

Weaknesses

CWE-73

Affected products

• Pdf Editor (Foxit)
• Pdf Reader (Foxit)
• Foxit Pdf Editor (Foxit Software Inc.)
• Foxit Pdf Reader (Foxit Software Inc.)

References

• https://www.foxit.com/support/security-bulletins.html