CVE-2026-111417
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A broken access control vulnerability exists in the Foxit official website's HTML-to-PDF conversion service due to the use of a shared token for submitted conversion documents. This may allow unauthorized users to access documents submitted by other users.
Risk Assessment
Unauthorized users could access documents submitted by other users, potentially leading to disclosure of confidential information. This may compromise privacy and data security.
Recommendation
Replace the shared token with unique, strong tokens tied to the session or user. Implement proper access control for submitted documents.
Other vulnerabilities in Foxit official website
See all- CVE-2026-111419High
A sensitive information exposure vulnerability exists on the Foxit official website because JavaScript code contains third-party authorization information. This may allow unauthorized parties to obtain or misuse the exposed credentials.
- CVE-2026-111418High
A server-side request forgery (SSRF) vulnerability exists in the Foxit official website's HTML-to-PDF conversion service. Support for ZIP-formatted input can bypass restrictions on requests to internal IP addresses, potentially allowing discovery of internal network resources.
Original NVD description (English source)
A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service due to the use of a shared token for submitted conversion documents. This may allow unauthorized users to access documents submitted by other users.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS