Foxit PDF Editor Cloud XSS Vulnerabilities Patched
Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Feb 5, 2026
Foxit released security updates for Foxit PDF Editor Cloud (and related Foxit eSign components) to address two cross-site scripting (XSS) flaws that could allow arbitrary JavaScript execution in a victim’s browser when handling crafted content. The issues are tracked as CVE-2026-1591 and CVE-2026-1592 (both CWE-79) and were attributed to insufficient input validation and improper output encoding that allowed untrusted data to be embedded into the application’s HTML.
The vulnerable functionality includes the File Attachments list and Layers panel, where attackers could inject payloads via crafted attachment filenames or manipulated layer names inside PDFs, requiring user interaction (e.g., opening/interacting with malicious documents) and typically authenticated access. Both CVEs are rated moderate severity with CVSS v3.0 6.3; exploitation could expose sensitive information available to the user’s session (e.g., document contents and session data). Foxit’s guidance is to ensure affected services are updated; the most recent referenced update for PDF Editor Cloud was released February 3, 2026.
