CVE-2025-66521: Foxit PDF Editor Cloud XSS Vulnerability

CVE-2025-66521 Overview

CVE-2025-66521 is a stored cross-site scripting (XSS) vulnerability in Foxit PDF Editor Cloud at pdfonline.foxit.com. The flaw resides in the Trusted Certificates feature. Attackers can inject a crafted payload into the certificate name field. The application later renders this value into the DOM without proper sanitization. The script executes each time a user loads the Trusted Certificates view.

The vulnerability maps to [CWE-79] Improper Neutralization of Input During Web Page Generation. Exploitation requires authenticated access and user interaction, but the stored nature means the payload fires repeatedly against every victim who views the affected page.

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in the browser context of any user viewing the Trusted Certificates list, enabling session theft, UI redress, and actions-on-behalf-of-user within Foxit PDF Editor Cloud.

Affected Products

Foxit PDF Editor Cloud (pdfonline.foxit.com)
Trusted Certificates feature in the hosted service
Vendor: Foxit

Discovery Timeline

2025-12-19 - CVE-2025-66521 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-66521

Vulnerability Analysis

The vulnerability is a stored XSS in the Trusted Certificates management interface of Foxit PDF Editor Cloud. When a user adds or imports a trusted certificate, the application accepts a certificate name string from the client. The server persists this value and later returns it as part of the certificate list payload. The front-end renders the name directly into the DOM without encoding HTML-significant characters.

Because the certificate name is stored server-side, the injected JavaScript runs for every subsequent viewer of the Trusted Certificates view, not only the attacker. In a multi-tenant or shared workspace context, this expands the blast radius to collaborators who open the same certificate store.

Successful exploitation runs script in the origin of pdfonline.foxit.com. An attacker can read session cookies that are not marked HttpOnly, call authenticated API endpoints on behalf of the victim, exfiltrate document metadata, or stage follow-on social-engineering through UI manipulation.

Root Cause

The root cause is missing output encoding on a user-controlled string that is reflected into an HTML context. The certificate name should be treated as untrusted text and escaped using context-appropriate encoding before DOM insertion. Instead, the application concatenates or injects the raw value, allowing <script> tags and event-handler attributes to execute.

Attack Vector

The attacker authenticates to Foxit PDF Editor Cloud with low privileges. The attacker then creates or imports a trusted certificate and sets the certificate name to a crafted payload containing JavaScript. Any user who later opens the Trusted Certificates view triggers execution of the payload in their browser session.

No verified public proof-of-concept code is available for this issue. See the Foxit Security Bulletins for vendor-supplied technical detail.

Detection Methods for CVE-2025-66521

Indicators of Compromise

Trusted certificate entries whose name field contains HTML tags, <script>, on*= event handlers, javascript: URIs, or encoded variants such as <script.
Outbound requests from browser sessions on pdfonline.foxit.com to unexpected external domains shortly after loading the Trusted Certificates view.
Unexpected API calls originating from authenticated user sessions that correlate with Trusted Certificates page loads.

Detection Strategies

Audit stored certificate names in the Foxit PDF Editor Cloud tenant for strings containing angle brackets, quotes, or JavaScript keywords.
Deploy a Content Security Policy (CSP) in report-only mode and alert on script-src violations originating from the Trusted Certificates page.
Review web application firewall (WAF) logs for POST or PUT requests to certificate-management endpoints carrying script-like payloads in the name parameter.

Monitoring Recommendations

Instrument browser-side telemetry to flag inline-script execution and anomalous fetch or XMLHttpRequest activity on the certificate list view.
Correlate account activity for users who recently imported certificates with session anomalies such as new IPs, token reuse, or privilege changes.
Track Foxit security bulletin updates and subscribe to vendor advisories for remediation status.

How to Mitigate CVE-2025-66521

Immediate Actions Required

Review and remove suspicious entries from the Trusted Certificates list in each tenant, especially names containing HTML or script syntax.
Restrict who can import or create trusted certificates to administrative roles until a vendor fix is confirmed.
Invalidate active sessions for users who may have viewed a tampered Trusted Certificates list and rotate exposed credentials or API tokens.

Patch Information

Foxit tracks fixes for its cloud offerings through the Foxit Security Bulletins page. Because pdfonline.foxit.com is a hosted service, remediation is delivered server-side by the vendor. Confirm with Foxit support that the Trusted Certificates rendering path has been patched for your tenant.

Workarounds

Avoid using the Trusted Certificates view in shared or multi-user workspaces until the vendor confirms a fix.
Enforce a strict Content Security Policy at the browser or proxy level that blocks inline script execution on pdfonline.foxit.com.
Use browser isolation or a dedicated profile for Foxit PDF Editor Cloud sessions to limit cookie and token exposure.

bash

# Example CSP header to block inline script execution on the hosted app
# Apply at your forward proxy or browser enterprise policy for pdfonline.foxit.com
Content-Security-Policy: default-src 'self'; \
  script-src 'self'; \
  object-src 'none'; \
  base-uri 'none'; \
  frame-ancestors 'none'; \
  report-uri /csp-report