Loading vulnerability…
Stored XSS in Foxit PDF Editor Cloud File Upload Feature
CVE-2026-1591 is a stored cross-site scripting vulnerability in Foxit PDF Editor Cloud (pdfonline) affecting the file upload feature and related upload file list display. The flaw is caused by improper escaping and insufficient sanitization of a user-controlled username value before it is embedded into the rendered file list. As a result, an attacker can supply a crafted username containing script payloads, have that payload stored by the application, and trigger arbitrary JavaScript execution when another user views the affected list in the browser. The issue affects pdfonline.foxit.com before 2026-02-03.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary JavaScript execution in the security context of the vulnerable Foxit PDF Editor Cloud application in a victim’s browser. This can enable session hijacking, access to sensitive data visible within the application session, execution of actions on behalf of the victim, user-interface redressing, phishing, and redirection to attacker-controlled content. Availability impact is not prominently indicated, but confidentiality and limited integrity impacts are plausible within the affected application context.
If you can’t patch tonight, do this now.
If immediate remediation cannot be verified, reduce exposure by limiting access to the affected cloud instance to trusted users, monitoring for suspicious or malformed usernames and unexpected script execution associated with upload list views, and applying compensating browser-side and application-side controls such as a strict Content Security Policy. Where operationally feasible, temporarily restrict or disable the affected upload and listing workflow until the fix is confirmed.
Patch, then assume compromise.
Apply the vendor fix deployed for Foxit PDF Editor Cloud on 2026-02-03 or later. The underlying issue should be remediated by ensuring proper contextual output encoding and escaping of user-controlled fields, especially usernames rendered in the upload file list, and by validating or sanitizing those fields at input time. Defense-in-depth hardening such as a restrictive Content Security Policy and secure cookie settings can further reduce exploitability and post-exploitation impact.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.