In response to findings that exposed weaknesses in the way user-supplied data was processed within interactive components, Foxit Software has issued a set of security fixes intended to address newly identified cross-site scripting vulnerabilities. 

Due to the flaws in Foxit PDF Editor Cloud and Foxit eSign, maliciously crafted input could be rendered in an unsafe manner in the user's browser, potentially allowing arbitrary JavaScript execution during authenticated sessions. 

The fundamental problem was an inconsistency in input validation and output encoding in some UI elements (most notably file attachment metadata and layer naming logic), which enabled attacker-controlled payloads to persist and be triggered during routine user interactions. 

Among these issues, the most important one, CVE-2026-1591, affected the File Attachments list and Layers panel of Foxit PDF Editor Cloud, thus emphasizing the importance of rigorously enforcing client-side trust boundaries in order to prevent the use of seemingly low-risk document features as attack vectors. 

These findings were supported by Foxit's confirmation that the identified weaknesses were related to a specific way in which certain client-side components handled untrusted input within a cloud environment. Affected functionality allowed for the processing of user-controlled values — specifically file attachment names and PDF layer identifiers — without sufficient validation or encoding prior to rendering in the browser. 

By injecting carefully constructed payloads into the application's HTML context, carefully constructed payloads could be executed upon the interaction between an authenticated user and the affected interface components. In response to these security deficiencies, Foxit published its latest security updates, which it described as routine security and stability enhancements that require no remediation other than ensuring deployments are up to date. 

The advisory also identifies two vulnerabilities, tracked as CVE-2026-1591 and CVE-2026-1592, which are both classified under CWE-79 for cross-site scripting vulnerabilities. Each vulnerability has a CVSS v3.0 score of 6.3 and is rated Moderate in severity according to the advisory. 

Foxit PDF Editor Cloud is impacted by CVE-2026-1591, which has a significant impact on its File Attachments and Layers panels due to insufficient input validation and improper output encoding which can allow arbitrary JavaScript execution from the browser. 

The vulnerability CVE-2026-1592 poses a comparable risk through similar paths to data handling. Both vulnerabilities were identified and responsibly disclosed by Novee, a security researcher. However, the potential consequences of exploitation are not trivial, even if user interaction is required. In order to inject a script into a trusted browser context, an attacker would have to persuade a logged-in user to open or interact with a specially crafted attachment or altered layer configuration. 

By executing this script, an attacker can hijack a session, obtain unauthorized access to sensitive document data, or redirect the user to an attacker-controlled resource. As a result, the client-side trust assumptions made by document collaboration platforms pose a broader risk, particularly where dynamic document metadata is not rigorously sanitized. 

During the disclosure period, the source material did not enumerate specific CVE identifiers for each individual flaw, apart from those referenced in the advisory. The vulnerability involved in cross-site scripting has been extensively documented across a wide array of web-based applications and is routinely cataloged in public vulnerability databases such as MITRE's CVE repository.

XSS vulnerabilities in unrelated platforms, such as those described in CVE-2023-38545 and CVE-2023-38546, underscore the broader mechanics and effects of this attack category. This type of example is not directly related to Foxit products, but nevertheless is useful for gaining an understanding of how similar weaknesses may be exploited when web-rendered interfaces mishandle user-controlled data. 

Technically, Foxit PDF Editor Cloud is exploitable via the way it ingests, stores, and renders user-supplied metadata within interactive components like the File Attachments list and Layers dialog box. If input is not rigorously validated, an attacker may embed executable content (such as script tags or event handlers) into attachment filenames or layer names embedded within a PDF file without rigorous input validation. 

Upon presenting these values to the browser without appropriate output encoding, the application unintentionally enables the browser to interpret the injected content as active HTML or JavaScript as opposed to inert text. As soon as the malicious script has been rendered, it is executed within the security context of the authenticated user's session. 

The attacker can exploit the execution environment to gain access to session tokens and other sensitive browser information, manipulate the on-screen content, or redirect the user to unauthorized websites. Foxit cloud environments can be compromised with scripts that can perform unauthorized actions on behalf of users in more advanced scenarios. 

It is important to note that the risk is heightened by the low interaction threshold required to trigger exploitation, since simply opening or viewing a specially crafted document may trigger an injected payload, emphasizing the importance of robust client-side sanitization in cloud-based document platforms. 

These flaws are especially apparent in enterprise settings where Foxit PDF Editor Cloud is frequently integrated into day-to-day collaboration workflows. In such environments, employees exchange and modify documents sourced from customers, partners, and public repositories frequently, thereby increasing the risk that maliciously crafted PDFs could enter the ecosystem undetected. 

As part of its efforts to mitigate this broader risk, Foxit also publicly revealed and resolved a related cross-site scripting vulnerability in Foxit eSign, tracked as CVE-2025-66523, which was attributed to improper handling of URL parameters in specially constructed links. 

By enabling users to access these links with authenticated access, the untrusted input could be introduced into JavaScript code paths and HTML attributes without sufficient encoding, which could result in privilege escalation or cross-domain data exposure. A fix for this problem was released on January 15, 2026. 

Foxit confirmed that all identified vulnerabilities, including CVE-2026-1591, CVE-2026-1592, and CVE-2025-66523, have been fully addressed thanks to updates that strengthen both input validation and output encoding across all affected components. As a result of Foxit PDF Editor Cloud's automated updates or standard update mechanisms, customers are not required to perform any additional configuration changes. 

However, organizations are urged to verify that all instances are running the latest version of the application and remain alert for indicators such as unexpected JavaScript execution, anomalous editor behavior, or irregular entries in application logs which may indicate an attempt at exploitation.

Based on aggregate analysis, these issues are the result of a consistent breakdown in the platform's handling of user-controlled metadata during rendering of the File Attachments list and Layers panel. Insufficient validation controls allow attackers to introduce executable content through seemingly benign fields, such as attachment filenames or layer identifiers, through which malicious content may be introduced. This content, since it is not properly encoded, is interpreted by the browser as active code rather than plain text due to the lack of proper output encoding.

The injected JavaScript executes within the context of an authenticated session when triggered, resulting in a variety of outcomes, including data disclosure, interface manipulation, forced navigation, and unauthorised actions under the user's privilege. In addition to the low interaction threshold, the operational risks posed by these flaws are also highlighted by their limited access. 

While Foxit's remediation efforts address the immediate technical deficiencies, effective risk management extends beyond patch deployment alone. Organizations must ensure that all cloud-based instances are operating on current versions by applying updates promptly. 

In addition to these safeguards, other measures can be taken to minimize residual exposure, such as restricting document collaboration to trusted environments, enforcing browser content security policies, and monitoring application behavior for abnormal script execution.

Additional safeguards, such as web application firewalls and intrusion detection systems, are available at the perimeter of the network to prevent known injection patterns from reaching end users. Together with user education targeted at handling unsolicited documents and suspicious links, these measures can mitigate the broader threat posed by client-side injection vulnerabilities in collaborative documents.