MinorCritical vulnerability

CVE-2026-91797 (CVSS 7.8)

NVD · officialPublished Sep 23, 2026Risk 23/100EPSS 0.2%

Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malicious attachments being able to be written to directories outside the expected secure area when the PDF is opened.

Technical details

CVSS

7.8

AV:LocalAC:LowPR:NoneUI:RequiredC:HighI:HighA:High

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source