CVE-2026-91797

Executive Summary

CVE-2026-91797 is a path traversal (directory traversal) vulnerability in Foxit PDF Editor and Foxit PDF Reader, rated CVSS 7.8 (High). The product fails to validate the directory traversal path derived from an attachment's file name, allowing a malicious PDF to write an embedded attachment to a location outside the intended secure directory when the victim opens the file. Successful exploitation requires user interaction (opening a crafted PDF) but grants high confidentiality and integrity impact on the local host, making it a viable weaponization primitive in document-based malware delivery.

Technical Analysis

The vulnerability class is directory traversal (CWE-73, "External Control of File Name or Path"), applied to the attachment-extraction routine of Foxit PDF Editor/Reader.

PDF documents can carry embedded file attachments as document-level objects. When a user opens a PDF that contains an attachment, the reader typically offers to save or extract that attachment. The extraction routine is expected to confine the written file to a designated, expected secure area (for example, a sandboxed temp or user-approved directory). According to the NVD description, Foxit PDF Editor/Reader "failed to validate the directory traversal path in the attachment file name." The attachment's file name is attacker-controlled input embedded in the PDF; because the software does not validate traversal sequences in that name, the resolved output path can escape the expected secure directory.

The precise traversal encoding used, the exact extraction code path, and any normalization routine are not disclosed in the available data. At the vulnerability-class level, this is a classic "uncontrolled file-name-to-path" flaw: the application concatenates or resolves a user-supplied name against a base directory without canonicalizing and verifying that the final path remains within that base. When the attacker supplies traversal sequences (e.g., ../ sequences or equivalent encoded forms) in the attachment name, the resolved path points outside the intended directory.

Contributing factors consistent with a CVSS 7.8/High rating:

• Attack Vector (AV:L) — the attacker's payload is a local file the victim must open; no remote network service is directly targeted.
• Attack Complexity (AC:L) and Privileges Required (PR:N) — no special conditions or credentials are needed; the flaw is deterministic given a crafted attachment name.
• User Interaction (UI:R) — the victim must open the malicious PDF.
• Scope (S:U) — impact stays within the security authority of the user's session.
• Confidentiality/Integrity (C:H/I:H) — arbitrary file write outside the secure area can overwrite user-writable files or plant content in sensitive locations; Availability (A:H) is not reflected as high in this vector, though file overwrite can have availability effects.

Exploitation Scenarios

No public PoC or exploit code is available; the attack chain below is inferred from the vulnerability class and the NVD description only. No specific function names, API parameters, or code paths are asserted because none are provided.

1. Reconnaissance / target identification. The attacker identifies a target population that uses Foxit PDF Editor or Foxit PDF Reader. The attack is delivered as a document, so reconnaissance focuses on delivering a legitimate-looking PDF to the victim (email attachment, download link, shared drive). No network fingerprinting of the victim host is required by the vulnerability itself.

2. Triggering the flaw. The attacker crafts a PDF containing an embedded file attachment whose name embeds traversal sequences. When the victim opens the PDF and the attachment is extracted/saved, the application fails to validate the traversal path in the attachment file name, so the file is written to a directory outside the expected secure area.

3. Payload / execution method (vulnerability-class level). The write location is attacker-influenced via the attachment name. In the general path-traversal-arbitrary-write pattern, the attacker uses this to place a file into a directory the user can write to — for example a startup/autostart location or a directory consumed by another application — which can lead to code execution or configuration tampering. The exact directories reachable in this specific flaw are not disclosed in the available data; the writable set is bounded by the victim process's file-system permissions.

4. Post-exploitation impact. Given C:H/I:H, the attacker can read/modify files outside the intended secure area as constrained by the process's rights, tamper with data, and potentially stage a second-stage payload in a location that a later process will load or execute. Persistence and privilege escalation depend on where the write lands and are not guaranteed by the traversal alone.

Impact Assessment

CVSS 3.1 base score 7.8 (High) — AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is trivially triggerable once a malicious PDF is opened (AC:L, no privileges), which lowers the skill barrier and makes mass document-delivery campaigns practical. The requirement for user interaction (UI:R) is the main brake on severity; however, PDFs are routinely opened by knowledge workers, so exploitation is realistic.

Business impact centers on endpoint integrity: arbitrary file write outside a trusted directory can corrupt user data, plant files that other software trusts, and seed further compromise. Because the flaw is in a widely deployed document reader, blast radius spans any organization whose endpoints run Foxit PDF Editor/Reader and whose users open untrusted PDFs (email, web, file shares, removable media). No CISA KEV listing and no confirmed in-the-wild exploitation are reported in the available data, so this is currently a latent weaponization primitive rather than a known active campaign. Supply-chain exposure is not indicated (OSV packages: N/A). The single-user scope (S:U) means the immediate impact is confined to the victim's session context, though that context may itself enable later, higher-impact stages.

Detection Guidance

Sigma Rule

title: Potential Foxit PDF Attachment Path Traversal File Write (CVE-2026-91797)
id: 8f2c1a44-7b9e-4d13-9c2a-5e6b0d9f3a71
status: experimental
description: Detects file creation events consistent with a PDF reader writing an attachment to a path that escapes the expected secure directory (traversal sequences in output path).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91797
author: valtersit.com
date: 2026-01-01
logsource:
  category: file_event
  product: windows
detection:
  selection_proc:
    Image|endswith:
      - '\FoxitPDFReader.exe'
      - '\FoxitPDFEditor.exe'
      - '\FoxitReader.exe'
  selection_path:
    TargetFilename|contains:
      - '..\'
      - '../'
  condition: selection_proc and selection_path
falsepositives:
  - Legitimate applications writing filenames that happen to contain literal '..' sequences
level: high
tags:
  - attack.t1204.002
  - cve.2026.91797

YARA Rule

rule CVE_2026_91797_Foxit_PDF_Traversal_Attachment
{
    meta:
        description = "Detects PDF files containing attachment file names with directory traversal sequences (CVE-2026-91797)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91797"
        date = "2026-01-01"
        severity = "high"

    strings:
        $pdf_hdr = "%PDF-"
        $ef = "/EmbeddedFile"
        $fname = "/F ("
        $traversal1 = "../"
        $traversal2 = "..\\"

    condition:
        $pdf_hdr at 0 and $ef and $fname and any of ($traversal*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91797 Potential Foxit PDF Traversal Attachment Download"; flow:established,to_client; file_data; content:"%PDF-"; content:"/EmbeddedFile"; content:"/F ("; pcre:"/\/F\s*\([^)]*(\.\.\/|\.\.\\)/"; filestore; classtype:trojan-activity; sid:202691797; rev:1; reference:cve,2026-91797; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

file where process.name in ("FoxitPDFReader.exe", "FoxitPDFEditor.exe", "FoxitReader.exe") and
  wildcard(file.path, "*../*") or wildcard(file.path, "*..\\*")

Splunk SPL Query

index=endpoint (EventCode=11 OR EventCode=4663)
| search (Image="*\\FoxitPDFReader.exe" OR Image="*\\FoxitPDFEditor.exe" OR Image="*\\FoxitReader.exe")
| eval path=coalesce(TargetFilename, ObjectName)
| where match(path, "\\.\.[\\/]")
| table _time, host, user, Image, path
| sort - _time

Wazuh OSSEC Rule

<group name="foxit,cve-2026-91797,">
  <rule id="2026917" level="12">
    <if_sid>550</if_sid>
    <field name="file">\.\.[\\/]</field>
    <description>CVE-2026-91797: Possible Foxit PDF attachment path traversal file write detected</description>
    <mitre>
      <id>T1204.002</id>
    </mitre>
    <group>file_write,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or advisory is identified in the available data.

1. Immediate mitigations

• Do not open PDFs from untrusted sources (email attachments, unsolicited downloads, removable media) with Foxit PDF Editor/Reader. Open untrusted documents only in a sandboxed or disposable environment (isolated VM, container, or browser-based viewer with restricted rights).
• Prefer extracting/opening attachments only when the source is trusted; treat any prompt to save an embedded attachment from an unknown PDF as untrusted.
• Apply endpoint controls that limit where a document reader may write (e.g., constrained user temp directories, application allowlisting, and least-privilege user accounts) so that any traversal-derived write is contained.
• Disable or restrict automatic handling of embedded attachments at the application level where such a setting exists; require explicit user confirmation and review the proposed save location.

2. Patch / upgrade steps

• Monitor the Foxit security advisories page and the NVD entry for CVE-2026-91797 for a vendor fix; no patched version is currently identifiable.
• When a patched release is published, upgrade Foxit PDF Editor/Reader to the fixed version on all endpoints and validate the deployment through your software inventory / patch management tooling.

3. Long-term hardening

• Centralize PDF handling through a hardened, isolated viewer or a document conversion service that does not honor embedded attachments.
• Maintain an aggressive update cadence for document readers and other file-format parsers, which are high-value exploitation targets.
• Deploy detection coverage (Sigma/YARA/Suricata/Elastic/Splunk/Wazuh rules above) to identify traversal-in-path writes by PDF readers.
• Enrich endpoint telemetry with file-creation events from document applications and alert on writes outside expected directories.
• Conduct user awareness training on PDF-based delivery; reinforce that opening an attachment-bearing PDF from an unknown sender is a risk.

References

• NVD — CVE-2026-91797: https://nvd.nist.gov/vuln/detail/CVE-2026-91797
• MITRE CWE-73 — External Control of File Name or Path: https://cwe.mitre.org/data/definitions/73.html
• FIRST EPSS — CVE-2026-91797 (not yet scored as of available data): https://api.first.org/data/v1/epss?cve=CVE-2026-91797
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-91797 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Foxit Security Advisories (monitor for vendor fix): https://www.foxit.com/support/security-bulletins.html
• MITRE ATT&CK T1204.002 — User Execution: Malicious File: https://attack.mitre.org/techniques/T1204/002/

No public proof-of-concept, exploit code, Nuclei template, or confirmed in-the-wild exploitation campaigns are identified in the available data. No threat actor attribution is supported.