Foxit Software Inc. foxit.com vulnerabilities

Latest Foxit Software Inc. foxit.com CVEs

Newest publication first

1. CVE-2026-111417 Cross-user Document Access on Foxit Official Website's HTML-to-PDF Service

   Published 2026-10-29

   High·CVSS 7.5 EPSS 0.35%

   A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service due to the use of a shared token for submitted conversion documents. This may allow unauthorized users to access documents submitted by other users.

2. CVE-2026-111418 SSRF and JavaScript Execution in the Foxit Official Website's HTML-to-PDF Service

   Published 2026-10-29

   High·CVSS 7.5 EPSS 0.43%

   A server-side request forgery (SSRF) vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service. Support for ZIP-formatted input can bypass restrictions on requests to internal IP addresses, potentially allowing discovery of internal network resources.

3. CVE-2026-111419 Hardcoded API Token in Foxit Official Website

   Published 2026-10-29

   High·CVSS 8.6 EPSS 0.35%

   A sensitive information exposure vulnerability exists on the Foxit official website because JavaScript code contains third-party authorization information. This may allow unauthorized parties to obtain or misuse the exposed credentials.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.