CVE-2026-1592

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1592", "assignerOrgId": "14984358-7092-470d-8f34-ade47a7658a2", "state": "PUBLISHED", "assignerShortName": "Foxit", "dateReserved": "2026-01-29T07:31:16.225Z", "datePublished": "2026-02-03T07:59:13.097Z", "dateUpdated": "2026-02-04T16:09:38.510Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "pdfonline.foxit.com", "vendor": "Foxit Software Inc.", "versions": [{"status": "affected", "version": "before 2026\u201102\u201103"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Novee"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the Create New Layer feature. Unsanitized user input is embedded into the HTML output, allowing arbitrary JavaScript execution when the layer is referenced.</span>\n\n<p>This issue affects pdfonline.foxit.com: before 2026\u201102\u201103.</p>"}], "value": "Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the Create New Layer feature. Unsanitized user input is embedded into the HTML output, allowing arbitrary JavaScript execution when the layer is referenced.\n\nThis issue affects pdfonline.foxit.com: before 2026\u201102\u201103."}], "impacts": [{"descriptions": [{"lang": "en", "value": "Potential arbitrary JavaScript execution"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "14984358-7092-470d-8f34-ade47a7658a2", "shortName": "Foxit", "dateUpdated": "2026-02-03T08:05:44.550Z"}, "references": [{"url": "https://www.foxit.com/support/security-bulletins.html"}], "source": {"discovery": "UNKNOWN"}, "title": "Stored XSS via Create New Layer Field found in Foxit PDF Editor Cloud", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-04T16:09:30.096311Z", "id": "CVE-2026-1592", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T16:09:38.510Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1592", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-04T16:09:30.096311Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T16:09:35.585Z"}}], "cna": {"title": "Stored XSS via Create New Layer Field found in Foxit PDF Editor Cloud", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Novee"}], "impacts": [{"descriptions": [{"lang": "en", "value": "Potential arbitrary JavaScript execution"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Foxit Software Inc.", "product": "pdfonline.foxit.com", "versions": [{"status": "affected", "version": "before 2026\u201102\u201103"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.foxit.com/support/security-bulletins.html"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the Create New Layer feature. Unsanitized user input is embedded into the HTML output, allowing arbitrary JavaScript execution when the layer is referenced.\n\nThis issue affects pdfonline.foxit.com: before 2026\u201102\u201103.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the Create New Layer feature. Unsanitized user input is embedded into the HTML output, allowing arbitrary JavaScript execution when the layer is referenced.</span>\n\n<p>This issue affects pdfonline.foxit.com: before 2026\u201102\u201103.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "14984358-7092-470d-8f34-ade47a7658a2", "shortName": "Foxit", "dateUpdated": "2026-02-03T08:05:44.550Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1592", "state": "PUBLISHED", "dateUpdated": "2026-02-04T16:09:38.510Z", "dateReserved": "2026-01-29T07:31:16.225Z", "assignerOrgId": "14984358-7092-470d-8f34-ade47a7658a2", "datePublished": "2026-02-03T07:59:13.097Z", "assignerShortName": "Foxit"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "pdfonline.foxit.com", "vendor": "Foxit Software Inc.", "versions": [{"status": "affected", "version": "before 2026\u201102\u201103"}]}], "source": "14984358-7092-470d-8f34-ade47a7658a2"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:foxit:pdf_editor_cloud:*:*:*:*:*:*:*:*", "matchCriteriaId": "C22F83B5-EAE7-4F85-A1DA-48617FB7E718", "versionEndExcluding": "2026-02-03", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the Create New Layer feature. Unsanitized user input is embedded into the HTML output, allowing arbitrary JavaScript execution when the layer is referenced.\n\nThis issue affects pdfonline.foxit.com: before 2026\u201102\u201103."}, {"lang": "es", "value": "Foxit PDF Editor Cloud (pdfonline) contiene una vulnerabilidad de cross-site scripting almacenada en la funci\u00f3n 'Crear nueva capa'. La entrada de usuario no saneada se incrusta en la salida HTML, permitiendo la ejecuci\u00f3n arbitraria de JavaScript cuando se hace referencia a la capa.\n\nEste problema afecta a pdfonline.foxit.com: antes del 2026?02?03."}], "id": "CVE-2026-1592", "lastModified": "2026-06-17T10:16:07.693", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 4.2, "source": "14984358-7092-470d-8f34-ade47a7658a2", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1592", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-04T16:09:30.096311Z", "version": "2.0.3"}}]}, "published": "2026-02-03T08:16:15.043", "references": [{"source": "14984358-7092-470d-8f34-ade47a7658a2", "tags": ["Vendor Advisory"], "url": "https://www.foxit.com/support/security-bulletins.html"}], "sourceIdentifier": "14984358-7092-470d-8f34-ade47a7658a2", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "14984358-7092-470d-8f34-ade47a7658a2", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T00:23:29.358856+00:00", "value": {"mitigation_remediation": ["Update to a version released after 2026\u201102\u201103 or apply any vendor patch that addresses the stored XSS in the Create New Layer feature.", "If updating is not immediately possible, disable or restrict the ability for users to create new layers that contain unsanitized input, or enforce stricter input validation by configuring the service or a web application firewall to block malicious scripts.", "Deploy a Content Security Policy that limits script execution within PDF Editor Cloud pages, reducing the damage if an XSS payload is somehow injected."], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The vulnerability exists in Foxit Software Inc.\u2019s PDF Editor Cloud service (pdfonline) for all releases prior to 2026\u201102\u201103. No later versions are impacted.", "description_and_impact": "Foxit PDF Editor Cloud allows a user to create a new layer with unsanitized input that is stored and later rendered as part of the document\u2019s HTML. When an unsuspecting user opens a document containing the malicious layer, the script executes in their browser, providing the attacker with the ability to run arbitrary JavaScript, steal session cookies, or perform further actions in the user\u2019s context. This stored cross\u2011site scripting flaw is a classic input validation weakness (CWE\u201179).", "risk_and_exploitability": "With a CVSS base score of 6.3 and an EPSS below 1\u202f%, the likelihood of exploitation in the wild is low, and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog. The flaw is typically triggered when a user creates a malicious layer that is later viewed by an attacker or other users, so the attack vector is via the web interface of the service. Although its impact is limited to the victim\u2019s browser session, successful exploitation could lead to credential theft, data exfiltration, or defacement of shared documents."}}}}, "created": "2026-02-04T12:14:55.042415+00:00", "updated": "2026-04-18T00:30:25.711128+00:00", "vendors": ["foxitsoftware", "foxitsoftware$PRODUCT$pdfonline"]}