Home
MEDIUM: 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NDefault status
unaffected
Versions 2026.1.1 and earlier
affected
Versions 14.0.4 and earlier
affected
Versions 13.2.4 and earlier
affected
Default status
unaffected
Versions 2026.1.1 and earlier
affected
Description
The input file does not need to be strictly in a structurally valid PDF format. Instead, after reviewing the content, the original document disguised as a PDF will be sent to the parser. Malicious documents will construct malicious external entities that, through the protocol, point to local paths, thereby allowing access to any local files within the user's permission range.
Problem types
Improper Restriction of XML External Entity Reference (CWE-611)
Product status
Versions 2026.1.1 and earlier
Versions 14.0.4 and earlier
Versions 13.2.4 and earlier
Versions 2026.1.1 and earlier
Credits
Trung Nguyen (@everping) of CyStack
References
www.foxit.com/support/security-bulletins.html