CVE-2025-66502: Foxit PDF Editor Cloud XSS Vulnerability

CVE-2025-66502 Overview

CVE-2025-66502 is a stored cross-site scripting (XSS) vulnerability in Foxit PDF Editor Cloud at pdfonline.foxit.com. The flaw resides in the Page Templates feature, where an authenticated user can submit a crafted payload as a template name. The application later renders this value into the Document Object Model (DOM) without proper sanitization. Each time the affected PDF document loads, the injected script executes in the context of the victim's session. The issue is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attackers with low-privileged accounts can store malicious JavaScript that executes in any user's browser when the affected PDF is opened, enabling session theft and action hijacking within the Foxit PDF Editor Cloud interface.

Affected Products

Foxit PDF Editor Cloud (pdfonline.foxit.com)
Page Templates feature within Foxit PDF Editor Cloud
Hosted service instances exposed to end users through the browser

Discovery Timeline

2025-12-19 - CVE-2025-66502 published to the National Vulnerability Database (NVD)
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2025-66502

Vulnerability Analysis

The vulnerability lies in how Foxit PDF Editor Cloud processes user-supplied template names in the Page Templates feature. The service accepts arbitrary strings when a user creates or renames a template. These values are persisted server-side and later written directly into the rendered DOM of the PDF editing interface. Because the application omits output encoding, HTML and JavaScript syntax submitted as a template name is parsed by the browser as executable markup. The attack requires some user interaction, such as opening the affected PDF, and the resulting code runs in a changed security scope, affecting other users of the shared document.

Root Cause

The root cause is missing contextual output encoding when the Page Templates feature renders stored template names into the HTML response. User input is treated as trusted markup rather than data. There is no evidence of a Content Security Policy (CSP) or sanitization library intercepting the payload before it reaches the DOM.

Attack Vector

An authenticated attacker creates a page template whose name contains a JavaScript payload. The server stores the payload without sanitization. When any user, including document collaborators, loads the affected PDF through pdfonline.foxit.com, the browser parses the injected markup and executes the attacker's script. The payload runs with the privileges of the viewing user's session, allowing session token theft, forced actions against the Foxit account, phishing overlays, or lateral movement to linked cloud documents. The attack vector is network-based and requires user interaction.

No verified proof-of-concept code is available. See the Foxit Security Bulletins for vendor-provided technical details.

Detection Methods for CVE-2025-66502

Indicators of Compromise

Template names stored in Foxit PDF Editor Cloud that contain HTML tags such as <script>, <img onerror=>, or <svg onload=>.
Outbound browser requests to unexpected domains originating from pdfonline.foxit.com sessions.
Unusual Foxit account activity, such as unauthorized template changes or session reuse from new IP addresses following a PDF viewing event.

Detection Strategies

Review web proxy and browser telemetry for requests to pdfonline.foxit.com that return responses containing unescaped <script> fragments inside template metadata.
Hunt for client-side errors or anomalous postMessage, fetch, or XMLHttpRequest calls initiated from the Foxit origin that target non-Foxit domains.
Correlate PDF-open events with subsequent credential or token submissions to external hosts within a short time window.

Monitoring Recommendations

Enable browser isolation or endpoint telemetry that captures script execution context when users access Foxit cloud services.
Alert on new or modified page templates whose metadata fields contain angle brackets, javascript: URIs, or event-handler attributes.
Monitor identity provider logs for Foxit sign-ins followed by anomalous OAuth consent or API usage.

How to Mitigate CVE-2025-66502

Immediate Actions Required

Restrict Foxit PDF Editor Cloud access to trusted users and limit sharing of PDFs that contain user-created page templates.
Audit existing templates for suspicious names containing HTML or JavaScript syntax and remove affected entries.
Rotate session tokens and reset credentials for any account that interacted with a compromised PDF.
Review the Foxit Security Bulletins and apply any fixes released by the vendor.

Patch Information

Foxit addresses hosted service vulnerabilities through server-side updates to pdfonline.foxit.com. No standalone client patch is required for this cloud service issue. Confirm remediation status by consulting the Foxit Security Bulletins page for CVE-2025-66502.

Workarounds

Avoid using the Page Templates feature until the vendor confirms remediation, especially for documents shared with external collaborators.
Deploy a browser-level Content Security Policy or extension that blocks inline script execution on the pdfonline.foxit.com origin where feasible.
Instruct users not to open shared PDFs originating from untrusted parties within the Foxit cloud editor.
Use web filtering to limit access to pdfonline.foxit.com from sensitive workstations until the vendor advisory confirms the fix.

bash

# Example: block Foxit cloud editor at an egress proxy until remediation is confirmed
# Squid ACL example
acl foxit_cloud dstdomain pdfonline.foxit.com
http_access deny foxit_cloud