Foxit PDF Editor Cloud Stored Cross-Site Scripting Vulnerability in Portfolio Feature

A stored cross-site scripting vulnerability has been identified in the Portfolio feature of Foxit PDF Editor Cloud. This issue arises because user-uploaded SVG files are not properly sanitized before being integrated into the HTML structure. Consequently, any HTML or JavaScript embedded within a manipulated SVG can execute when the Portfolio file list is displayed. This vulnerability affects all versions of Foxit PDF Editor Cloud prior to the December 1, 2025 update.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Remediation

Users can update to the latest version of Foxit PDF Editor Cloud, which includes security and stability enhancements. No action is needed for users already on the latest version.