Foxit pdfonline.foxit.com Stored Cross-Site Scripting in Portfolio SVG Handling
Vulnerability Description
A stored cross-site scripting (XSS) vulnerability exists in the Portfolio feature of the Foxit PDF Editor cloud (pdfonline.foxit.com). User-supplied SVG files are not properly sanitized or validated before being inserted into the HTML structure. As a result, embedded HTML or JavaScript within a crafted SVG may execute whenever the Portfolio file list is rendered.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-66520
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Novee
More from Foxit Software Inc.
View All →Affected Vendor
Foxit Software Inc.
View all reports →