CVE-2020-10892 in PhantomPDF
Summary
by MITRE
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the communication API. The issue lies in the handling of the CombineFiles command, which allows an arbitrary file write with attacker controlled data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9830.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/06/2026
CVE-2020-10892 represents a critical remote code execution vulnerability affecting Foxit PhantomPDF version 9.7.0.29478 that demonstrates a classic arbitrary file write flaw within the application's communication API. This vulnerability operates under the Common Weakness Enumeration classification of CWE-22, which specifically addresses improper limitation of a pathname to a restricted directory, commonly known as path traversal attacks. The flaw manifests in the CombineFiles command implementation where the application fails to properly validate or sanitize file paths during the file combination process, creating an opportunity for attackers to write malicious content to arbitrary locations on the target system. The vulnerability requires user interaction to exploit, meaning victims must either visit a malicious webpage or open a specially crafted malicious file that triggers the vulnerable code path within the PDF reader. This attack vector aligns with the MITRE ATT&CK framework's technique T1203, which covers exploitation for client execution through malicious documents or web content. The security implications are severe as successful exploitation allows attackers to execute arbitrary code with the privileges of the current process, potentially leading to full system compromise. The vulnerability's impact extends beyond simple code execution since the attacker-controlled data can be written to any location that the application has write permissions, including system directories or critical application files. This arbitrary file write capability provides attackers with multiple attack paths including DLL injection, binary planting, or direct modification of executable components. The issue specifically affects the communication API layer where the CombineFiles command processes user-supplied data without adequate input validation, creating a dangerous condition where attacker-controlled file paths can be interpreted by the application. From a defensive perspective, this vulnerability highlights the importance of implementing proper input validation and sanitization measures, particularly in APIs that handle file operations and user-provided data. Organizations should prioritize immediate patching of affected systems and implement network segmentation to limit potential attack surface. The vulnerability also underscores the necessity of application sandboxing and privilege separation techniques to contain potential exploitation attempts and prevent lateral movement within compromised environments.