Foxit PDF Editor/Reader EUVD-2026-85125

Requires the victim to open an attacker-crafted PDF in Foxit PDF Editor or Foxit PDF Reader that contains an embedded attachment whose file name includes directory-traversal sequences; on open the product fails to validate the attachment path and writes the file outside the expected secure directory. Limiting factors: exploitation is local and user-interaction-gated (AV:L/UI:R) - the attacker cannot trigger it remotely without the user opening the document - and the raw impact is a file-write, so full compromise depends on writing to a location that yields code execution (e.g. autorun/startup path or overwriting a trusted file). No authentication is required of the attacker (PR:N).

The vendor CVSS of 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) is internally consistent with the description: a path-traversal (CWE-73) in PDF attachment file-name handling that writes files outside the intended secure area. AV:L plus UI:R correctly capture that the attack is not remote-automatable - a victim must locally open a crafted PDF - so despite the 'HIGH' rating this is a user-interaction-gated client-side flaw, not a wormable network bug. The C:H/I:H/A:H triad is optimistic for a pure file-write primitive; arbitrary write to a controlled location (e.g. a startup/autorun path or overwriting a trusted binary/config) can plausibly escalate to full compromise, but that is a secondary consequence rather than a direct read of confidential data, so C:H in particular is defensible only through follow-on code execution. There is no EPSS score, no CISA KEV listing, and no public POC referenced - the sole reference is Foxit's generic security-bulletins index page with no version, patch level, or advisory ID - so exploitation is unproven and this reads as a real-but-not-urgent client-side issue rather than an actively exploited priority. Missing data to verify with the vendor: exact fixed version, affected platform(s), and whether the write primitive has been demonstrated to reach code execution.

An attacker crafts a PDF whose embedded attachment carries a traversal sequence (e.g. ..\..\) in its file name and delivers it via email or a download link; when the victim opens it in Foxit PDF Editor/Reader, the malicious attachment is written outside the sandboxed/temp area to an attacker-chosen path such as a user startup folder, achieving code execution on next logon. No public exploit code is referenced at time of analysis, and exploitation requires the victim to open the file (UI:R).