CVE-2026-91801

Executive Summary

CVE-2026-91801 is a path traversal vulnerability (CWE-22) in Foxit PDF Editor and Foxit PDF Reader affecting the handling of embedded PDF resources. Insufficient validation of resource file paths may permit an attacker to write files outside their intended directory, which can escalate to arbitrary code execution in the context of the current user. Exploitation requires local access and user interaction (the victim must open a crafted PDF), so impact is concentrated on endpoint users of Foxit's desktop PDF products.

Technical Analysis

The vulnerability resides in the resource-extraction path of Foxit's PDF parsing logic. When a PDF document embeds external resources (such as images, sound objects, JavaScript components, or other associated files), the reader/editor must resolve a path for each embedded object and write or reference it in a working directory. CVE-2026-91801 arises when the application fails to sufficiently validate or canonicalize those resource file paths before performing file operations. Path traversal sequences embedded in a resource path (for example, relative directories or absolute path constructs) can direct the write operation outside the intended sandboxed directory.

The CWE classification (CWE-22 — Improper Limitation of a Pathname to a Restricted Directory) confirms the flaw class: the application takes a path derived from attacker-influenced content and does not confine it to a legitimate base directory. The NVD description states plainly that "insufficient validation of resource file paths may allow files to be written outside their intended locations," and that this "potentially enabl[es] arbitrary code execution." The concrete mechanism by which the out-of-bounds write becomes code execution is not specified in the available data; no function names, file paths, API parameters, or directory names are disclosed. Analysis must therefore remain at the vulnerability-class level.

The attack surface is the document-open event. Because Foxit PDF Editor/Reader is a desktop client, the vulnerable code path is reached whenever a user opens a malicious PDF that carries a crafted embedded-resource declaration. The CVSS vector (AV:L — Local, UI:R — User Interaction Required, PR:N — No Privileges Required, S:U — Unchanged Scope) reflects that the attacker delivers a file and relies on the victim to open it; no network service is exposed, and no prior credentials are needed.

The CVSS scoring breakdown underpins the severity assessment:

• AV:L — attack vector is local; the malicious document must be obtained and opened by the victim.
• AC:L — no special conditions beyond opening the file; the attack is repeatable and low-complexity.
• PR:N — no authentication or privileges are needed on the target host.
• UI:R — successful exploitation requires a user to open the crafted PDF.
• S:U — the vulnerable component and the impacted component are the same; the write occurs within the application's security context, not crossing a scope boundary.
• C:H / I:H / A:H — confidentiality, integrity, and availability are rated High: an arbitrary write within the user's privileges exposes user-accessible data (C), permits modification of files (I), and can corrupt or destroy data (A). Combined with the code-execution potential, these ratings are consistent.

CWE-22 is a well-known, systematically exploitable class. Common mitigations that are evidently absent or incomplete here include canonicalization of resource paths, rejection of traversal sequences, and enforcement of a chroot-style base directory for all embedded-resource write operations.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-91801. The attack chain below is therefore inferred strictly from the vulnerability class (CWE-22) and the NVD description. No specific function names, file paths, or parameters are asserted, because none are disclosed.

1. Reconnaissance and target identification: The attacker identifies an environment where Foxit PDF Editor or Foxit PDF Reader is deployed as the default or commonly used PDF handler. Delivery does not require any listening service on the target — the victim's mailbox, a shared drive, a web download, or a chat channel are sufficient vectors. The attacker needs no knowledge of the target OS beyond confirming Foxit is the opened application.

2. Triggering the flaw: The attacker crafts a PDF that embeds one or more resources whose associated path values contain directory-traversal constructs. When the victim opens the PDF, Foxit processes the embedded resources and resolves their paths. Because validation of the resource file paths is insufficient, the resolved path is not confined to the intended location, and the file write escapes the intended directory.

3. Execution method (vulnerability-class level): The out-of-bounds write can, per the NVD description, be leveraged toward arbitrary code execution. At the class level, this typically means the write can plant content into a location that the operating system or the application subsequently loads or executes — for example a startup, plugin, or profile location writable by the user. The precise technique is not described in the available data, so a concrete payload format cannot be specified. What is determinable is that the write occurs with the privileges of the user who opened the document (PR:N, S:U), so anything that user can write to and that leads to execution is in scope.

4. Post-exploitation impact: With C:H/I:H/A:H, a successful attacker can read user-accessible data, modify or plant files, and disrupt availability. Because the write is arbitrary within the user's permissions, the confidentiality and integrity of the user's files are directly exposed, and the code-execution potential elevates this from a file-write bug to a potential endpoint compromise, confined to that user's privilege level (no privilege escalation is claimed by the vector, as Scope is Unchanged).

Defenders should assume that targeted delivery of a rigged PDF to a Foxit user is the realistic exploitation path, with no public tooling currently in circulation.

Impact Assessment

Affected systems are endpoints running Foxit PDF Editor or Foxit PDF Reader. The vendor does not publish an affected-version range in the available data, so all versions in use must be treated as potentially vulnerable until Foxit confirms otherwise.

Business impact centers on endpoint integrity. The flaw allows files to be written outside intended locations and offers a pathway to arbitrary code execution with the victim user's privileges. The confidentiality, integrity, and availability ratings are all High. Because scope is Unchanged and privileges are not required beyond the user's own session, the blast radius on a single host is significant but bounded to that user: the attacker gains the same foothold the user already has, but no automatic cross-host or system-level escalation is implied by the vector. On shared workstations or servers where an administrative user opens documents, the practical impact is proportionally larger. In phishing-driven campaigns, a single rigged PDF could yield code execution across many recipients, making this a credible initial-access or payload-delivery tool even without remote vector classification.

No CISA KEV listing exists, no EPSS score has been published by FIRST.org, and no exploit code is tracked. The risk is presently latent rather than actively exploited, but the absence of a patch (Patch Confidence 0/4) means exposure persists indefinitely for unmitigated deployments.

Detection Guidance

Sigma Rule

title: Potential Foxit PDF Resource Path Traversal File Write
id: 3f6b9c2e-1c4a-47d1-9a0e-7c2f5b8e9d10
status: experimental
description: Detects file creation events initiated by Foxit PDF Editor/Reader that may indicate exploitation of CVE-2026-91801 path traversal in embedded PDF resource handling.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91801
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1204
  - cve.2026.91801
logsource:
  category: file_event
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\FoxitPDFReader.exe'
      - '\FoxitPDFEditor.exe'
      - '\FoxitReader.exe'
  selection_write:
    EventType: 'CreateFile'
  selection_suspicious_paths:
    TargetFilename|contains:
      - '\Startup\'
      - '\AppData\Local\Temp\..\'
      - '\..\..\'
  condition: selection_image and selection_write and selection_suspicious_paths
falsepositives:
  - Legitimate extraction of embedded PDF resources to temporary directories
level: medium

YARA Rule

rule CVE_2026_91801_Foxit_PDF_Resource_Traversal
{
    meta:
        description = "Detects PDF documents containing embedded resource path traversal patterns potentially targeting Foxit PDF Reader/Editor CVE-2026-91801"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91801"
        cve = "CVE-2026-91801"
    strings:
        $pdf = "%PDF-"
        $traversal1 = "../"
        $traversal2 = "..\\"
        $embeddedfile = "/EmbeddedFile"
        $filespec = "/Filespec"
        $f = "/F ("
    condition:
        $pdf at 0 and $embeddedfile and (any of ($traversal1, $traversal2)) and (any of ($filespec, $f))
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-91801 Possible Foxit PDF Resource Path Traversal Delivery"; flow:established,to_server; content:"%PDF-"; depth:1024; content:"/EmbeddedFile"; content:".."; within:64; reference:cve,2026-91801; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91801; classtype:attempted-user; sid:202691801; rev:1;)

Elastic Detection

file where process.name in ("FoxitPDFReader.exe", "FoxitPDFEditor.exe", "FoxitReader.exe")
  and event.action == "creation"
  and wildcard(file.path, "*\\Startup\\*", "*\\..\\*")

Splunk SPL Query

index=endpoint (Image="*\\FoxitPDFReader.exe" OR Image="*\\FoxitPDFEditor.exe")
| where like(TargetFilename, "%\\Startup\\%") OR like(TargetFilename, "%\\..\\%") OR like(TargetFilename, "%\\Temp\\..\\%")
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, Image, TargetFilename
| sort - count

Wazuh OSSEC Rule

<group name="windows,pdf,cve-2026-91801,">
  <rule id="2026918" level="10">
    <if_sid>60100</if_sid>
    <field name="win.eventdata.image">\.*\\FoxitPDF(Reader|Editor)\.exe</field>
    <field name="win.eventdata.targetFilename">\.*(\.\.\\|Startup\\).*</field>
    <description>CVE-2026-91801 - Suspicious file write by Foxit PDF product (possible embedded resource path traversal)</description>
    <mitre>
      <id>T1204</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — UNPATCHED. No patch evidence exists from any tracked source, and no vendor fix or workaround is documented in the available data.

1. Immediate mitigations:

   • Treat all Foxit PDF Editor/Reader deployments as exposed. Restrict who may open untrusted PDF documents, especially documents received via email or containing embedded files.
   • Consider temporarily changing the default PDF handler to an alternative viewer with resource-sandboxing until a fix is available, or opening only PDFs from vetted sources.
   • Apply application allow-listing and least-privilege so that the user context Foxit runs in cannot write to sensitive directories (startup folders, configuration directories).
   • Harden email and web gateways to quarantine PDF attachments that contain embedded-file objects, and strip embedded resources where business needs permit.
   • Enable file-integrity monitoring and the detection rules above; monitor for writes to startup, plugin, and profile directories from Foxit processes.

2. Patch/upgrade steps:

   • No patch currently exists. Monitor Foxit's official security advisory channels for a fixed release and apply it as soon as it is published.
   • Once a patch is available, prioritize upgrade on endpoints where administrative or high-value users routinely open PDFs.
   • Because no affected version range is published, verify version applicability against the vendor's eventual advisory rather than assuming only older releases are impacted.

3. Long-term hardening:

   • Configure Foxit to disable automatic execution of embedded files and JavaScript, and prefer protected/sandboxed viewing modes for untrusted documents.
   • Maintain an asset inventory of PDF-handling applications and subscribe to their vulnerability feeds.
   • Enforce the principle of least privilege for interactive accounts to reduce what an arbitrary write can reach.
   • Adopt a vulnerability-management workflow that tracks unpatched CVEs with a defined compensating-controls path, since patch confidence for this CVE is zero.

References

• NVD — CVE-2026-91801: https://nvd.nist.gov/vuln/detail/CVE-2026-91801
• MITRE CWE-22 — Improper Limitation of a Pathname to a Restricted Directory: https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK T1204 — User Execution: https://attack.mitre.org/techniques/T1204/
• Foxit Security Advisories (vendor advisory portal; consult for a future fix): https://www.foxit.com/support/security-bulletins.html
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-91801 NOT listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-91801 in the available data. No public proof-of-concept or Nuclei template exists. EPSS has not yet scored this CVE.