Foxit PDF Editor and Reader fail to validate directory traversal characters in attachment file names, enabling a malicious PDF to cause the application to write files outside the intended secure area. This flaw allows an attacker to place arbitrary files on the system and could lead to code execution if the written files are executable. The weakness is a Path Traversal vulnerability, classified as CWE‑73.

The vulnerability impacts Foxit Software Inc.’s PDF Editor and PDF Reader products. Version details are not supplied, so all installed instances may be affected until a vendor patch is applied.

The CVSS score of 7.8 reflects a moderate‑to‑high impact. The EPSS score of less than 1 % suggests that exploitation is unlikely at present, and it is not listed in the CISA KEV catalog. Attack requires a user to open a specially crafted PDF; the application then writes the malicious attachment path to an unintended directory, potentially enabling code execution or other integrity violations.