Vulnerability · Published Sep 23, 2026 · Assigned by Foxit
CVE-2026-91797Foxit PDF Editor/Reader Portfolio Directory Traversal Remote Code Execution Vulnerability
High 7.8
In plain English
A high-severity security flaw in Foxit PDF Editor from Foxit Software Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.3%top 71.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malicious attachments being able to be written to directories outside the expected secure area when the PDF is opened.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Foxit Software Inc. | Foxit PDF Editor | Versions 2026.2 and earlierVersions 14.0.7 and earlierVersions 13.2.6 and earlier |
| Foxit Software Inc. | Foxit PDF Reader | Versions 2026.2 and earlier |
Weakness: CWE-73 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H