CVE-2026-1591Patch(foxit / pdf_editor_cloud)

🚨 CVE-2026-1591: Foxit PDF Editor Cloud Stored XSS Alert 🚨 Foxit Software A stored cross-site scripting vulnerability has been disclosed in Foxit PDF Editor Cloud, allowing attackers to inject persistent JavaScript via the file upload username field. The payload executes in the browsers of all users who later view affected file lists. A public proof of concept is available. Risk Severity: High. Public proof of concept available. Stored XSS in a cloud collaboration platform with broad user exposure. Impact: Persistent JavaScript execution in victim browsers. Session token theft and account takeover. Credential harvesting via phishing overlays. Unauthorized changes to document sharing and workflow approvals. Targeted attacks against business users with ongoing access. Root Cause: CWE-79, Improper Neutralization of Input During Web Page Generation. User supplied username metadata is stored during file upload and rendered without output encoding in shared file list views. Attackers can: Upload a file with a malicious JavaScript payload embedded in the username field. Persist the payload in upload metadata. Trigger execution when other users open shared document lists. Steal sessions, redirect users, or manipulate document permissions. Are You Affected? Vulnerable. All Foxit PDF Editor Cloud instances prior to the February 3, 2026 security patch. Fixed. Cloud service patched on 2026-02-03. Verify the admin panel shows a last update date of 2026-02-03 or later. Immediate Action Required: Verify your Foxit PDF Editor Cloud instance is fully patched. Force global session invalidation and require user reauthentication. Audit historical uploads for suspicious username values containing script or HTML payloads. Monitor logs for abnormal uploads and unexpected outbound browser requests. Stored XSS in collaboration tools turns one upload into a mass compromise. Patch and invalidate sessions immediately. 🛡️ #ostorlabCVE

Foxit PDF Editor Cloud の脆弱性 CVE-2026-1591／1592 が FIX：入力サニタイズ不備と XSS の恐れ https://iototsecnews.jp/2026/02/03/foxit-pdf-editor-vulnerabilities-let-attackers-execute-arbitrary-javascript/ この問題の原因は、PDF 内の “レイヤー名” や “添付ファイル名”といった、ユーザーが自由に書き換えられる情報を表示する際に、その中に含まれる悪意のプログラム (JavaScript) を無効化する処理 (サニタイズやエスケープ) が欠落していたことにあります。具体的には、攻撃者が特殊な名前 (例：<script>alert(1)</script> など) を付けたレイヤーや添付ファイルを含む PDF を作成し、それを被害者に開かせます。そのレイヤー・パネルや添付ファイル・リストをユーザーが表示するときに、名前として埋め込まれていたコードが、”文字” としてではなく “命令” としてブラウザ内で実行されてしまいます。これがクロスサイト・スクリプティング (XSS) と呼ばれる脆弱性の正体です。ご利用のチームは、ご注意ください。 #CVE20261591 #CVE20261592 #Foxit #PDFEditor

Foxit patches multiple XSS vulnerabilities (CVE-2026-1591, CVE-2026-1592, CVE-2025-66523) in PDF Editor Cloud and eSign, fixing input validation flaws that risk arbitrary JavaScript execution. #FoxitUpdates #XSSFix #USA https://ift.tt/rbZ2pR0

CVE-2026-1591 Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the file upload feature. A malicious username is embedded into the upload fil… https://www.cve.org/CVERecord?id=CVE-2026-1591

Foxit PDF Editor Cloud users, update now! Critical XSS vulnerabilities (CVE-2026-1591, CVE-2026-1592) patched to prevent arbitrary JavaScript execution. https://thedailytechfeed.com/foxit-pdf-editor-patches-critical-vulnerabilities-allowing-arbitrary-javascript-execution/ #Security #Patch #Vulnerability #JavaScript #Update #Software #Threat #CVE #Cloud #Editor #Protection #Code #Exploit #Browser #Attack #Hacking #Tech #Safety #Digital #Web

🚨 Foxit patches XSS flaws in PDF Editor Cloud & eSign enabling arbitrary JavaScript execution Foxit fixed multiple moderate-severity XSS vulnerabilities (CVE-2026-1591 / CVE-2026-1592 in PDF Editor Cloud; CVE-2025-66523 in eSign) that let authenticated attackers inject script via attachment/layer fields or crafted URL parameters, risking session theft, data exposure, and malicious redirects. Update/ensure patched versions are deployed to eliminate this browser-context execution path. 🎯 Target: Global/Enterprise Productivity #️⃣ Category: #Vulnerability #BlueTeam 🔗 URL: https://cyberpress.org/foxit-pdf-editor-vulnerability/

CVE-2026-1591 Stored XSS Vulnerability in Foxit PDF Editor Cloud via Mal... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1591 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2