Description

A stored cross-site scripting (XSS) vulnerability exists in the Foxit Workspace's file share preview functionality. An attacker could upload a crafted file and share it with a victim. When the victim opens or previews the file, the embedded script executes in the application's origin, potentially accessing locally stored credentials and enabling credential theft.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-11-06T05:18:20.830Z",
  "pubdate": "2026-11-06T05:18:20.830Z",
  "executiveSummary": "A stored Cross-Site Scripting (XSS) vulnerability has been identified within the file share preview functionality of Foxit Workspace. This flaw allows an authenticated attacker to inject malicious scripts into the application environment via crafted files. The vulnerability manifests when a victim previews a malicious file, causing the embedded script to execute within the security context of the victim's session. The successful exploitation of this vulnerability enables attackers to perform unauthorized actions on behalf of the user, potentially leading to the theft of sensitive session tokens, locally stored credentials, or other sensitive information exposed within the application's origin. The risk is significant as it leverages the trust established by the file-sharing interface to execute arbitrary code in the user's browser, potentially facilitating further malicious activities within the enterprise environment.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper sanitization and validation of file content within the Foxit Workspace file preview engine. When a file is uploaded to the workspace and subsequently accessed via the preview feature, the application fails to adequately neutralize malicious scripts embedded within the file structure. This results in the reflection of malicious payloads during the rendering phase of the file preview process.\nThe attack flow begins with the adversary crafting a malicious file containing embedded JavaScript payloads designed to execute in the client-side environment. This file is then uploaded to a shared location within Foxit Workspace, either by a compromised account or via public share links if permitted by the application configuration. When a target victim interacts with the file preview interface, the application processes the crafted file and renders the malicious content directly into the Document Object Model (DOM) of the victim's browser.\nBecause the execution occurs within the origin of the Foxit Workspace web application, the injected script inherits the same-origin policy permissions associated with the victim's session. This grants the script access to sensitive DOM objects, including document.cookie (if not protected by HttpOnly flags), local storage, and session storage. An attacker can leverage this access to perform exfiltration of authentication tokens, perform unauthorized API requests under the victim's identity, or modify the content of the page to conduct phishing attacks.\nThe exploitation requirement is limited to the successful preview of a malicious file by an authenticated user. The vulnerability does not require the attacker to have administrative privileges on the server, as the impact is confined to the client-side execution context. The exposure is inherently tied to the application's file-sharing and preview mechanisms, which are critical components of the workspace functionality. The post-exploitation impact includes persistent session hijacking, lateral movement within the workspace by performing actions as the victim, and potential compromise of any sensitive data visible within the current browser session."
}