What is the CVSS score of CVE-2026-57259?

CVE-2026-57259 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Foxit PDF Reader CVE-2026-57259

EUVD-2026-42197 MEDIUM

Improper Restriction of XML External Entity Reference (CWE-611)

2026-07-08 Foxit

GHSA-cp35-rwwj-hqqf

XXE Foxit Pdf Editor Foxit Pdf Reader

6.5

CVSS 3.1 · Vendor: Foxit

Severity by source

Vendor (Foxit) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered file requires only user interaction to trigger; no privileges needed; confidentiality-only impact bounded to user's permission scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Foxit).

CVSS VectorVendor: Foxit

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 09:23 vuln.today

DescriptionCVE.org

The input file does not need to be strictly in a structurally valid PDF format. Instead, after reviewing the content, the original document disguised as a PDF will be sent to the parser. Malicious documents will construct malicious external entities that, through the protocol, point to local paths, thereby allowing access to any local files within the user's permission range.

AnalysisAI

XXE injection in Foxit PDF Editor and Foxit PDF Reader exposes any local file readable by the victim user when they open a maliciously crafted document disguised as a PDF. The parser processes documents that are not structurally valid PDFs, resolving attacker-controlled external XML entities that reference local filesystem paths via file:// or similar protocols, enabling out-of-band exfiltration of sensitive local files. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Craft XXE-payload document disguised as PDF

Delivery

Deliver file to victim via email or web

Exploit

Victim opens file in Foxit PDF Editor or Reader

Execution

Parser resolves malicious external entity with file:// URI

Persist

Local file contents returned to parser

Impact

Exfiltrate contents to attacker-controlled server

Access

Craft XXE-payload document disguised as PDF

Delivery

Deliver file to victim via email or web

Exploit

Victim opens file in Foxit PDF Editor or Reader

Execution

Parser resolves malicious external entity with file:// URI

Persist

Local file contents returned to parser

Impact

Exfiltrate contents to attacker-controlled server

Vulnerability AssessmentAI

Exploitation	The victim must actively open a maliciously crafted file using Foxit PDF Editor or Foxit PDF Reader - this is the sole prerequisite enforced by UI:R in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N scores 6.5 Medium, which fairly reflects the risk profile: network-deliverable with no authentication required, but constrained by mandatory user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker sends a phishing email to a target employee with an attachment disguised as a PDF invoice or contract; the file contains malicious XXE entity declarations referencing sensitive paths such as C:\Users\victim\.ssh\id_rsa or /home/victim/.aws/credentials. When the victim opens the file in Foxit PDF Reader or Editor, the parser resolves the external entities, reads the target files, and the attacker receives the exfiltrated content via a DNS or HTTP callback to an attacker-controlled server. …
Remediation	Upgrade Foxit PDF Editor and Foxit PDF Reader to the versions published in Foxit's security bulletin at https://www.foxit.com/support/security-bulletins.html. … Detailed patch versions, workarounds, and compensating controls in full report.