CVE-2026-91801: Foxit PDF Path Traversal Vulnerability

CVE-2026-91801 Overview

CVE-2026-91801 is a path traversal vulnerability in Foxit PDF Editor and Foxit PDF Reader. The flaw resides in the application's handling of embedded PDF resources. Insufficient validation of resource file paths allows files to be written outside their intended directories. An attacker can leverage this write primitive to place executable content in sensitive locations, potentially achieving arbitrary code execution in the context of the current user.

Exploitation requires the victim to open a crafted PDF document, aligning with the local attack vector and user interaction requirement described in the advisory.

Critical Impact
A specially crafted PDF can write files outside the intended resource directory, enabling arbitrary code execution under the user account that opened the document.

Affected Products

Foxit PDF Editor
Foxit PDF Reader
Refer to the Foxit Security Bulletin for specific affected versions

Discovery Timeline

2026-09-23 - CVE-2026-91801 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-91801

Vulnerability Analysis

The vulnerability is classified as a path traversal weakness [CWE-22]. Foxit PDF Editor and Reader parse embedded resource references within PDF documents when rendering or extracting content. The parser fails to normalize or constrain these resource paths to the expected working directory.

An attacker crafts a PDF that references resource paths containing directory traversal sequences such as ..\ or absolute paths. When the application processes the document, it writes the referenced resource to the attacker-controlled location. Writing an executable, script, or DLL to a startup, %TEMP%, or application load path converts the file write into code execution.

The attack requires local access in the sense that the malicious PDF must be delivered to and opened by the victim. Common delivery channels include email attachments, drive-by downloads, and shared file repositories.

Root Cause

The root cause is missing or insufficient canonicalization of file paths supplied through embedded PDF resource entries. The application trusts path components from the document without stripping traversal sequences or verifying the resolved path stays within the intended output directory.

Attack Vector

Exploitation follows a predictable chain. The attacker builds a PDF containing an embedded resource with a traversal path pointing to a sensitive filesystem location. The victim opens the file in a vulnerable version of Foxit PDF Editor or Reader. The application writes attacker-controlled bytes to the target path, achieving persistence or code execution when the planted file is later executed by the operating system or another application.

No authenticated network access is required. The full impact chain depends on user interaction with the malicious document.

See the Foxit Security Bulletin for vendor-provided technical details.

Detection Methods for CVE-2026-91801

Indicators of Compromise

PDF files containing embedded resource references with ..\, ../, or absolute path components
Unexpected file writes by FoxitPDFEditor.exe or FoxitPDFReader.exe to directories outside their installation and user profile paths
New executables, scripts, or DLLs appearing in startup folders, %APPDATA%, or %TEMP% shortly after opening a PDF

Detection Strategies

Inspect PDF documents at the email gateway for embedded resource entries containing traversal characters
Correlate Foxit process activity with file creation events in sensitive directories using EDR telemetry
Alert on Foxit processes spawning script interpreters such as cmd.exe, powershell.exe, or wscript.exe

Monitoring Recommendations

Enable command-line and file-write auditing on hosts running Foxit PDF products
Forward Foxit process telemetry to a centralized data lake for retrospective hunting
Track version inventory of Foxit installations to identify unpatched endpoints

How to Mitigate CVE-2026-91801

Immediate Actions Required

Apply the vendor patch listed in the Foxit Security Bulletin as soon as it is available for your version
Restrict opening of PDF documents from untrusted or external sources until patching is complete
Verify Foxit PDF Editor and Reader deployments across managed endpoints and prioritize updates

Patch Information

Foxit publishes fixed versions and remediation guidance through its security bulletin portal. Administrators should consult the Foxit Security Bulletin to identify the specific patched builds for Foxit PDF Editor and Foxit PDF Reader and deploy them through standard software distribution channels.

Workarounds

Disable automatic opening of PDF attachments in mail clients and browsers
Block or quarantine PDFs with embedded resources containing traversal sequences at the email gateway
Enforce application allow-listing to prevent execution of files written to user-writable directories
Consider using Protected View or a sandboxed reader configuration where available

bash

# Configuration example
# Refer to the Foxit Security Bulletin for vendor-specific hardening steps:
# https://www.foxit.com/support/security-bulletins.html