Exposure of Resource to Wrong Sphere in Foxit PDF Editor (formerly Foxit PhantomPDF) and Foxit PDF Reader for Windows - CVE-2026-91788
Published: September 23, 2026
Vulnerability identifier: #VU151807
CSH Severity: Medium
CVSS v4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-91788
CWE-ID: CWE-668
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose information.
The vulnerability exists due to improper attribute authorization checks in the app.activeDocs JavaScript API when handling certain JavaScript actions. A remote attacker can trick the victim into opening a document containing crafted JavaScript actions to disclose information.
The API can return full document objects for open documents in the same process.
Affected software
Foxit PDF Editor (formerly Foxit PhantomPDF)
Foxit PDF Reader for Windows
Foxit PDF Reader for Windows
How to mitigate CVE-2026-91788
Install security update from vendor's website.
Foxit PDF Editor (formerly Foxit PhantomPDF) - addressed in versions 13.2.7.24160, 14.0.8.33807, 2026.2.1.39815
Foxit PDF Reader for Windows - update to 2026.2.1.39815
Foxit PDF Reader for Windows - update to 2026.2.1.39815