CVE-2026-91797 in PDF Editor
Summary
by MITRE • 09/23/2026
Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malicious attachments being able to be written to directories outside the expected secure area when the PDF is opened.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in Foxit PDF Editor and Reader represents a critical failure in input validation regarding file system operations during document processing. Specifically, the application fails to properly sanitize or validate directory traversal sequences embedded within attachment filenames contained inside a PDF document. When a user opens a maliciously crafted PDF that includes an attachment with such a filename, the software processes this name without adequate checks for path manipulation characters like dot-dot-slash (../). This oversight allows an attacker to control the destination path where the file is extracted or written by the application. The core technical flaw lies in the absence of robust canonicalization and boundary checking mechanisms before executing write operations on the local filesystem, a common weakness when handling external data sources that are not fully trusted.
From a security architecture perspective, this issue aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The application assumes that attachments will be saved within a predefined secure sandbox or temporary directory but fails to enforce this constraint strictly. By allowing relative path traversal sequences in the filename, the attacker can escape the intended directory structure and write files to arbitrary locations on the victim's system. This behavior violates the principle of least privilege and proper isolation, as it grants the application-level process permissions to modify files outside its designated operational context without explicit user consent or awareness beyond opening the document itself.
The operational impact of this vulnerability is significant because it can lead to remote code execution if an attacker places a malicious executable script in a location where it will be automatically executed by other system processes or services. For instance, writing a payload into startup directories, application data folders monitored by security software for updates, or even replacing legitimate binaries could allow the attacker to gain persistent access to the compromised machine. Furthermore, this flaw can facilitate information disclosure if sensitive configuration files are overwritten with malicious content that exfiltrates data upon next execution, or it can cause denial of service by corrupting critical system files. The attack vector is primarily remote via email attachments or web downloads, requiring only social engineering to trick a user into opening the PDF, making it highly effective in targeted phishing campaigns.
Mitigation strategies for this vulnerability involve both immediate patching and long-term architectural improvements. Users should immediately update Foxit PDF Editor and Reader to the latest version where this input validation flaw has been corrected by the vendor. In environments where automatic updates are not feasible, network-level controls such as email gateways or web proxies can be configured to inspect PDF attachments for suspicious filename patterns containing directory traversal sequences before they reach end-user devices. From a development standpoint, implementing strict allow-listing of valid characters in filenames and enforcing absolute path resolution with verification against the intended base directory is essential. Security teams should also monitor endpoint detection systems for unusual file write activities originating from PDF reader processes to detect potential exploitation attempts in real time.