Description

Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malicious attachments being able to be written to directories outside the expected secure area when the PDF is opened.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-23T08:17:11.683Z",
  "pubdate": "2026-09-23T08:17:11.683Z",
  "executiveSummary": "This vulnerability is a directory traversal flaw residing within Foxit PDF Editor and Reader. The issue arises due to insufficient input validation of file names associated with embedded attachments within a PDF document.\nBy crafting a malicious PDF file containing an attachment with a path-traversal payload (e.g., sequences such as '../'), an attacker can bypass intended security boundaries. This allows the application to write files to unauthorized locations on the host system filesystem outside of the application's secure sandbox or expected storage directory.\nThe impact is significant, as it enables arbitrary file write capabilities, which can be leveraged to overwrite system binaries, configuration files, or place malicious executables in startup folders. Successful exploitation typically requires user interaction—specifically, the victim opening the maliciously crafted PDF file. This vulnerability poses a severe risk to system integrity and may facilitate remote code execution if an attacker successfully overwrites files that the system subsequently executes.",
  "technicalDetails": "The vulnerability is rooted in an improper neutralization of special elements in file paths processed by the Foxit PDF Editor and Reader attachment handling module. When a PDF file contains an embedded attachment, the application must extract and write this content to the local filesystem.\nThe root cause is a failure to sanitize or validate the 'filename' parameter of the attachment metadata against directory traversal sequences. When the application parses the attachment object, it fails to verify that the target destination directory resolves to a subdirectory of the intended secure extraction path. Because the application blindly trusts the provided file path metadata, it is susceptible to path injection attacks.\nThe attack flow proceeds as follows: 1. An attacker crafts a PDF document incorporating an attachment. 2. The attacker modifies the attachment's internal file path metadata, inserting '../' sequences to traverse out of the application's temporary directory. 3. The attacker distributes the PDF to a target. 4. Upon the target user opening the PDF, the application attempts to extract the embedded attachment.\nDuring the extraction process, the vulnerable component interprets the path-traversal strings, resulting in the file being written to a directory defined by the attacker. This process occurs with the privileges of the user running the Foxit application. Consequently, if the application is running with elevated privileges, the impact of the file write is amplified.\nThe post-exploitation scenario is particularly dangerous. If the attacker can write to a sensitive location, they may overwrite system startup files, Dynamic Link Libraries (DLLs) required by other applications, or configuration files. When the system or another application subsequently accesses the overwritten file, the attacker's injected code or configuration settings are loaded and executed. This effectively transitions the vulnerability from a file write issue to a potential arbitrary code execution or persistence mechanism. The vulnerability does not require authentication from the victim other than the action of opening the file, making it highly effective for social engineering campaigns."
}