CVE-2020-10890 in PhantomPDF
Summary
by MITRE
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the communication API. The issue lies in the handling of the ConvertToPDF command, which allows an arbitrary file write with attacker controlled data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9829.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/07/2026
CVE-2020-10890 represents a critical remote code execution vulnerability affecting Foxit PhantomPDF version 9.7.0.29478 that demonstrates a classic arbitrary file write flaw within the application's communication API. This vulnerability resides in the ConvertToPDF command implementation where insufficient input validation allows attackers to manipulate file system operations, enabling them to write malicious data to arbitrary locations on the target system. The flaw operates at the application layer and requires user interaction to be exploited, typically through visiting a malicious webpage or opening a specially crafted file that triggers the vulnerable code path. From a cybersecurity perspective, this vulnerability maps directly to CWE-22, which describes improper limitation of a pathname to a restricted directory, commonly known as path traversal or directory traversal attacks. The vulnerability's exploitation mechanism aligns with ATT&CK technique T1059.007 for command and scripting interpreter, as successful exploitation would allow attackers to execute arbitrary code with the privileges of the targeted user. The communication API component where this vulnerability exists serves as a critical attack surface since it handles external inputs from various sources including web-based documents and file-based operations. When an attacker successfully exploits this vulnerability, they can execute code in the context of the current process, potentially escalating privileges or establishing persistent access to the compromised system. The attack vector requires social engineering to convince users to interact with malicious content, which makes this vulnerability particularly dangerous in enterprise environments where users may inadvertently encounter compromised web pages or documents. The vulnerability's impact extends beyond simple code execution since it can be leveraged for privilege escalation, data exfiltration, or as a foothold for further network infiltration. Organizations using Foxit PhantomPDF 9.7.0.29478 should immediately implement mitigations including patching to the latest version, network segmentation to limit access to the application, and user education to avoid visiting untrusted websites or opening suspicious documents. The vulnerability also highlights the importance of secure coding practices in API development, specifically around input validation and file system access controls, which are fundamental requirements of secure software development lifecycle processes. This flaw demonstrates how seemingly routine document processing functionality can become a critical security risk when proper security controls are not implemented in the application's architecture.