CVE-2026-91797: Foxit PDF Editor Path Traversal Vulnerability

CVE-2026-91797 Overview

CVE-2026-91797 is a path traversal vulnerability in Foxit PDF Editor and Foxit PDF Reader. The product fails to validate directory traversal sequences in attachment file names embedded within PDF documents. When a user opens a crafted PDF, the application writes attachments to arbitrary file system locations outside the intended secure directory. The flaw is tracked under CWE-73: External Control of File Name or Path.

Critical Impact
A malicious PDF opened by a local user can drop attacker-controlled files to sensitive filesystem locations, enabling code execution paths through DLL planting, startup folder placement, or overwriting user configuration files.

Affected Products

Foxit PDF Editor
Foxit PDF Reader
Refer to the Foxit Security Bulletins for exact version ranges

Discovery Timeline

2026-09-23 - CVE-2026-91797 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-91797

Vulnerability Analysis

The vulnerability resides in the attachment extraction logic of Foxit PDF Editor and Reader. PDF documents can carry file attachments referenced by a file name field inside the file specification dictionary. Foxit's implementation trusts this file name and does not canonicalize or sanitize traversal sequences such as ..\ or ../ before writing the attachment to disk.

Exploitation requires user interaction. The victim must open a crafted PDF and trigger attachment extraction or an automated save action driven by the document. Because the write occurs with the privileges of the local user, an attacker can place executables, scripts, or configuration files into directories the user can write to, including the Windows Startup folder or application data directories.

Root Cause

The root cause is missing input validation on the attachment file name field. The application concatenates the untrusted name with a base output directory without rejecting parent-directory references or absolute path components. This maps directly to [CWE-73], where external control of a file path allows an attacker to redirect file operations.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a weaponized PDF through email, chat, or a compromised web download. When the victim opens the document in a vulnerable Foxit product and the attachment is written to disk, the traversal payload in the attachment name resolves to an attacker-chosen destination. Successful placement of a file in a code-loading location leads to arbitrary code execution in the user's context.

No public proof-of-concept exploit is currently listed, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-91797

Indicators of Compromise

File creation events originating from FoxitPDFReader.exe or FoxitPDFEditor.exe that write to paths outside the user's Documents or temporary attachment directories.
Unexpected files appearing in autostart locations such as %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup shortly after a PDF is opened.
PDF documents containing embedded file attachments where the /F or /UF file specification entries contain ..\ or ../ sequences.

Detection Strategies

Correlate process telemetry to flag Foxit processes writing executable file types (.exe, .dll, .lnk, .js, .bat) to unusual paths.
Inspect inbound PDFs at email and web gateways for file specification dictionaries containing traversal patterns.
Alert on Foxit child process creations that follow attachment extraction, which may indicate execution of a planted payload.

Monitoring Recommendations

Enable file system auditing on user-writable autostart and application load directories.
Ingest endpoint process and file telemetry into a central data lake for cross-host correlation of Foxit-originated writes.
Track Foxit product versions across the estate and alert on hosts running builds predating the fixed release identified in the Foxit Security Bulletins.

How to Mitigate CVE-2026-91797

Immediate Actions Required

Upgrade Foxit PDF Editor and Foxit PDF Reader to the fixed versions listed in the Foxit Security Bulletins.
Instruct users to avoid opening PDF attachments from untrusted senders until patches are applied.
Block or quarantine inbound PDFs containing embedded attachments with traversal characters in file specification entries.

Patch Information

Foxit publishes fixed versions and detailed advisory information through its security bulletin portal. Administrators should consult the Foxit Security Bulletins for the specific patched release addressing CVE-2026-91797 and deploy through standard software distribution channels.

Workarounds

Disable automatic attachment extraction and prompt the user before saving any attached file from a PDF.
Restrict write permissions to autostart and application load directories for standard users where feasible.
Route PDF viewing for untrusted documents through a sandboxed or isolated environment until patching is complete.

bash

# Example: query installed Foxit versions across Windows endpoints
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Where-Object { $_.DisplayName -like 'Foxit PDF*' } |
  Select-Object DisplayName, DisplayVersion, InstallLocation