Live › vulnerability › CVE-2026-111417
Foxit's website HTML-to-PDF conversion service uses one shared token for all submitted conversion documents. An unauthorized user can reach documents that other people submitted.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 10:24 UTC. All times on this page are UTC.
Only the Foxit-hosted online HTML-to-PDF conversion service on foxit.com is affected, and Foxit says it fixed it on 2026-10-29. Teams that submitted sensitive documents to that service before then may have had them exposed; the sources do not mention Foxit's desktop or self-hosted products. Teams that never used the online converter can skip this.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| foxit.com HTML-to-PDF online conversion service | vendor | before 2026-10-29 | 2026-10-29 (server-side) |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service due to the use of a shared token for submitted conversion documents. This may allow unauthorized users to access documents submitted by other users.
This page as .md · .json · in your agent: get_signal("CVE-2026-111417")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.