CVE-2026-91801— Foxit PDF Editor/Reader RichMedia Annotation Directory Traversal Remote Code Execution Vulnerability
Quick assessment
Affected
Foxit Software Inc. Foxit PDF Editor
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
A path traversal vulnerability exists in Foxit PDF Editor/Reader's handling of embedded PDF resources. Insufficient validation of resource file paths may allow files to be written outside their intended locations, potentially enabling arbitrary code execution.
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-91801
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Foxit PDF Editor/Reader RichMedia Annotation Directory Traversal Remote Code Execution Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
A path traversal vulnerability exists in Foxit PDF Editor/Reader's handling of embedded PDF resources. Insufficient validation of resource file paths may allow files to be written outside their intended locations, potentially enabling arbitrary code execution.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Foxit Software Inc. | Foxit PDF Editor | Versions 2026.2 and earlier | - |
|
| Foxit Software Inc. | Foxit PDF Reader | Versions 2026.2 and earlier | - |
|
II. Public POCs for CVE-2026-91801
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-91801
请登录查看更多情报信息。
Same Patch Batch · Foxit Software Inc. · 2026-09-23 · 31 CVEs total
| CVE-2026-91803 | 8.8 HIGH | Security Vulnerability Report – Foxit PDF Editor/Reader Updater DLL Search Path Hijacking |
| CVE-2026-91800 | 8.8 HIGH | Foxit PDF Editor installer local privilege escalation |
| CVE-2026-91798 | 8.8 HIGH | Foxit PDF Editor/Reader Updater Privilege Escalation |
| CVE-2026-91813 | 8.8 HIGH | Foxit PDF Editor/Reader FoxitUpdater Race Condition Local Privilege Escalation Vulnerabili |
| CVE-2026-91812 | 7.9 HIGH | Foxit PDF Editor/Reader FoxitUpdater Improper Certificate Validation Local Privilege Escal |
| CVE-2026-91809 | 7.8 HIGH | Foxit PDF Editor/Reader Annotation Use-After-Free Information Disclosure Vulnerability |
| CVE-2026-91811 | 7.8 HIGH | Foxit PDF Editor/Reader PRC Stream Parsing Out-Of-Bounds Write Remote Code Execution Vulne |
| CVE-2026-91804 | 7.8 HIGH | Foxit PDF Editor/Reader Out-of-bounds Write Vulnerability While Rendering |
| CVE-2026-91806 | 7.8 HIGH | Foxit PDF Editor/Reader Doc Object Use-After-Free Information Disclosure Vulnerability |
| CVE-2026-91797 | 7.8 HIGH | Foxit PDF Editor/Reader Portfolio Directory Traversal Remote Code Execution Vulnerability |
| CVE-2026-91789 | 7.8 HIGH | Foxit PDF Editor/Reader U3D File Parsing Integer Overflow Remote Code Execution Vulnerabil |
| CVE-2026-91791 | 7.8 HIGH | Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability |
| CVE-2026-91816 | 7.8 HIGH | Foxit PDF Editor/Reader AcroForm Use-After-Free Remote Code Execution Vulnerability |
| CVE-2026-91790 | 7.8 HIGH | Foxit PDF Editor/Reader Doc Object Use-After-Free Information Disclosure Vulnerability |
| CVE-2026-91815 | 7.8 HIGH | Foxit PDF Editor/Reader JPEG2000 Parsing Memory Corruption Remote Code Execution Vulnerabi |
| CVE-2026-91818 | 7.8 HIGH | Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability |
| CVE-2026-91794 | 7.8 HIGH | Foxit PDF Editor/Reader DeviceN Colorspace Out-Of-Bounds Write Remote Code Execution Vulne |
| CVE-2026-91793 | 7.8 HIGH | Foxit PDF Editor/Reader Doc Object Use-After-Free Information Disclosure Vulnerability |
| CVE-2026-91799 | 7.8 HIGH | Foxit Editor/Reader Array resetForm Use-After-Free Vulnerability |
| CVE-2026-91795 | 7.8 HIGH | Foxit PDF Editor/Reader FileOpen Uninitialized Variable Remote Code Execution Vulnerabilit |
Showing top 20 of 31 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Foxit PDF Editor
-
CVE-2026-91788
Foxit PDF Editor/Reader Missing Authorization Information Di -
CVE-2026-91790
Foxit PDF Editor/Reader Doc Object Use-After-Free Informatio -
CVE-2026-91791
Foxit PDF Editor/Reader Annotation Use-After-Free Remote Cod -
CVE-2026-91792
Foxit PDF Editor/Reader Annotation Use-After-Free Remote Cod -
CVE-2026-91793
Foxit PDF Editor/Reader Doc Object Use-After-Free Informatio
Same vendor: Foxit Software Inc.
-
CVE-2026-91788
Foxit PDF Editor/Reader Missing Authorization Information Di -
CVE-2026-91790
Foxit PDF Editor/Reader Doc Object Use-After-Free Informatio -
CVE-2026-91791
Foxit PDF Editor/Reader Annotation Use-After-Free Remote Cod -
CVE-2026-91792
Foxit PDF Editor/Reader Annotation Use-After-Free Remote Cod -
CVE-2026-91793
Foxit PDF Editor/Reader Doc Object Use-After-Free Informatio
Same weakness: CWE-22
-
CVE-2026-96651
Plex Media Server path traversal -
CVE-2026-96276
Flatpak: flatpak: arbitrary write in host context via flatpa -
CVE-2026-96275
Flatpak: flatpak: arbitrary write access as root via extra-d -
CVE-2026-19438
Mint Workbench I Path traversal Vulnerability -
CVE-2026-18169
IBM Financial Transaction Manager (FTM) is Impacted by Multi
V. Comments for CVE-2026-91801
No comments yet