CVE-2026-119432 in Workspace
Summary
by MITRE • 11/06/2026
A stored cross-site scripting (XSS) vulnerability exists in the Foxit Workspace's file share preview functionality. An attacker could upload a crafted file and share it with a victim. When the victim opens or previews the file, the embedded script executes in the application's origin, potentially accessing locally stored credentials and enabling credential theft.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified as a stored cross-site scripting flaw within Foxit Workspace represents a significant security risk to enterprise environments relying on this platform for document management and collaboration. This specific weakness is located in the file share preview functionality, which is designed to render documents directly within the web interface without requiring local software installation. The core technical issue stems from insufficient input validation and sanitization of metadata or content embedded within uploaded files before they are processed by the preview engine. When an attacker uploads a maliciously crafted document containing executable script payloads, these scripts are stored on the server alongside legitimate file data. This persistence distinguishes it as a stored XSS vulnerability rather than a reflected one, meaning the payload remains active until manually removed from the system database or storage backend.
The operational impact of this flaw is severe due to its potential for widespread exploitation through social engineering tactics inherent in collaborative platforms. An attacker who successfully uploads and shares such a crafted file can trigger script execution whenever any user with access permissions opens or previews that specific document within their browser session. Because the malicious code executes in the context of the application's origin, it inherits all associated privileges and cookies belonging to the victim's active session. This environment allows the injected scripts to bypass same-origin policy restrictions, enabling them to interact freely with the Document Object Model and access sensitive data stored locally by the browser or transmitted during the session.
The primary consequence of this execution context is the potential for credential theft and session hijacking. The malicious script can exfiltrate authentication tokens, cookies containing session identifiers, or other personally identifiable information displayed within the preview pane to an external server controlled by the attacker. In enterprise settings where Foxit Workspace may be integrated with single sign-on solutions or store sensitive corporate documents, this capability allows attackers to compromise user accounts and gain unauthorized access to restricted resources. The persistence of the payload ensures that multiple victims can be affected over time without further action from the initial attacker, amplifying the blast radius significantly compared to transient vulnerabilities.
From a classification perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting and specifically falls under Stored XSS variants where user input is not validated before storage. In terms of adversary behavior mapping, it corresponds to the ATT&CK technique T1059 Command and Scripting Interpreter for execution and potentially T1213 Data from Information Repositories if used to harvest credentials or sensitive documents stored within the platform. Mitigation strategies must focus on implementing strict output encoding when rendering file metadata in the preview interface, ensuring that any special characters are escaped before being inserted into HTML contexts. Additionally, deploying a Content Security Policy with appropriate directives can restrict script execution origins and mitigate damage even if injection occurs. Regular security audits of third-party components used for document parsing and updating Foxit Workspace to versions where this input validation has been hardened are critical steps in reducing the attack surface associated with file preview functionalities.