Foxit HTML-to-PDF Service EUVD-2026-112697

Exploitation requires interacting with Foxit's official website HTML-to-PDF conversion service, which uses a shared token for submitted conversion documents; an unauthenticated remote attacker who obtains or reuses that shared token can access documents other users submitted to the service. No authentication, privileges, or user interaction are required (PR:N/UI:N/AC:L). The principal limiting factor is scope: this affects only documents processed through Foxit's hosted online converter - organizations not using that service are not exposed - and the vendor reports the service remediated as of 2026-10-29, so the exposure window is bounded to before that fix.

The signals point to a moderate, confidentiality-only issue rather than a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality impact but no integrity or availability impact - consistent with CWE-639 broken access control via a shared token. No EPSS score was provided, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and there is no POC or exploit reference in the input (only the vendor's security-bulletins landing page), so exploitation status is: no public exploit identified at time of analysis. The vuln.today decision label is 'this_week', indicating prompt but non-emergency remediation. A key contextual qualifier: the affected asset is Foxit's own hosted HTML-to-PDF conversion service (cpe foxit.com), not software deployed in customer environments - so the fix is server-side and, per the EUVD data, the service was remediated as of 2026-10-29. For most organizations this is therefore a data-exposure concern about documents they may have submitted to Foxit's online converter, not a patch-your-fleet action. Real priority is moderate: genuine unauthenticated confidentiality exposure of potentially sensitive uploaded documents, but bounded to a single vendor service that the vendor reports as already addressed.

A user submits a document to Foxit's online HTML-to-PDF conversion service; because a shared token governs access to submitted documents, an unauthorized remote user is able to reference or reuse that token and retrieve PDFs submitted by other users. Exploitation requires no authentication and no user interaction (PR:N/UI:N) and is low complexity (AC:L). No public exploit code is identified in the available sources.