CVE-2026-57259 Foxit PDF Editor/Reader XDP XFA XXE arbitrary local file read
Attackers can read arbitrary local files via XXE in Foxit PDF Editor/Reader by crafting malicious PDFs with external entities.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-57259?
CVE-2026-57259 is a medium-severity vulnerability in Foxit Pdf Editor, published on 8 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The input file does not need to be strictly in a structurally valid PDF format. Instead, after reviewing the content, the original document disguised as a PDF will be sent to the parser. Malicious documents will construct malicious external entities that, through the protocol, point to local paths, thereby allowing access to any local files within the user's permission range.
Weakness: CWE-611
Which versions are affected by CVE-2026-57259?
It affects 2 products.
Products include Foxit Pdf Editor, Foxit Pdf Reader.
How do I fix CVE-2026-57259?
No fix has been published for CVE-2026-57259 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-57259 being exploited?
There is no known exploitation of CVE-2026-57259 in the wild and no public exploit code.
Other vulnerabilities in Foxit Pdf Editor
Sources
Also known as GHSA-cp35-rwwj-hqqf.