Medium

Stored XSS in Foxit PDF Editor Cloud file upload list

IdentifiersCVE-2026-1591CWE-79· Improper Neutralization of Input…

CVE-2026-1591 is a stored cross-site scripting vulnerability in Foxit PDF Editor Cloud (pdfonline.foxit.com) affecting the file upload feature. A malicious username is embedded into the upload file list without proper escaping or output encoding, causing attacker-controlled script content to be rendered when the list is displayed to a user. The issue is described as stemming from insufficient input validation and improper output encoding of untrusted data in the browser-facing UI. According to the provided content, the issue affects pdfonline.foxit.com before 2026-02-03 and was fixed in the Foxit PDF Editor Cloud update released on 2026-02-03.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows arbitrary JavaScript execution in the victim’s browser in the context of pdfonline.foxit.com when the upload file list is viewed. This can enable session hijacking, account takeover actions within the application context, access to sensitive data available to the authenticated user, exfiltration of document-related information, UI redress/phishing, and redirection to attacker-controlled content. The provided material characterizes the issue as moderate severity and notes that enterprise collaboration workflows increase exposure.

Mitigation

If you can’t patch tonight, do this now.

If patch status cannot be immediately confirmed, reduce exposure by restricting access to pdfonline.foxit.com to trusted users, monitoring for suspicious or malformed usernames, and watching for anomalous script execution associated with the upload list view. Defense-in-depth measures include enforcing a strict Content Security Policy, using HttpOnly and SameSite cookie settings, and, if administratively possible, limiting or temporarily disabling the affected upload/listing workflow until remediation is confirmed.

Remediation

Patch, then assume compromise.

Apply and verify the Foxit vendor fix deployed for Foxit PDF Editor Cloud on 2026-02-03 or later. The underlying remediation is proper contextual output encoding/escaping of usernames rendered in the upload file list, along with validation and sanitization of usernames at creation or update time. Organizations should confirm that their Foxit PDF Editor Cloud environment is running the patched service version.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Foxit SoftwareFoxit Pdf Editor Cloud (Pdfonline)application

Foxit SoftwarePdf Editor Cloudapplication

Foxit SoftwarePdf Editor Cloud (Pdfonline)application

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

12 SOURCESView more in app

cyber security newsNews

Feb 18, 2026

16 Zero-Day Vulnerabilities in Popular PDF Platforms Enable Code Execution and Data Exfiltration

A medium-severity stored XSS vulnerability in Foxit’s Attachments feature.

the hacker newsNews

Feb 9, 2026

⚡ Weekly Recap: AI Skill Malware, 31Tbps DDoS, Notepad++ Hack, LLM Backdoors and More

Unknown (listed as a trending CVE affecting Foxit PDF Editor Cloud; no technical details provided in the content).

the hacker newsNews

Feb 9, 2026

⚡ Weekly Recap: AI Skill Malware, 31Tbps DDoS, Notepad++ Hack, LLM Backdoors and More

Unknown (listed as a trending CVE affecting Foxit PDF Editor Cloud; no technical details provided in the content).

the hacker newsNews

Feb 9, 2026

⚡ Weekly Recap: AI Skill Malware, 31Tbps DDoS, Notepad++ Hack, LLM Backdoors and More

Unknown (listed as a trending CVE affecting Foxit PDF Editor Cloud; no technical details provided in the content).

+5 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity3

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-1591

NVD

nvd.nist.gov/vuln/detail/CVE-2026-1591

MITRE CWE · CWE-79

Improper Neutralization of Input During Web…

Vendor Advisory

foxit.com/support/security-bulletins.html