High severity7.8NVD Advisory· Published Sep 23, 2026· Updated Oct 8, 2026

CVE-2026-91797

Description

Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malicious attachments being able to be written to directories outside the expected secure area when the PDF is opened.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Foxitsoftware/PDF Editor
cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*
Range: <=13.2.5.63482
Foxitsoftware/PDF Reader
cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*
Range: <=2026.2.0.39747
Foxitsoftware/PDF Editor/Readerllm-create

Patches

Vulnerability mechanics

References

www.foxit.com/support/security-bulletins.htmlnvdVendor Advisory

News mentions

Foxit PDF Editor/Reader: 23 Vulnerabilities Disclosed in Single Batch, Affecting Multiple Components
Vypr Intelligence · Sep 23, 2026
ZDI-26-733: Foxit PDF Reader Portfolio Directory Traversal Remote Code Execution Vulnerability
Zero Day Initiative · Sep 23, 2026

cvss	0.507
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000