{"id":"CVE-2026-119432","kind":"vulnerability","aliases":["CVE-2026-119432"],"related":[],"title":"Foxit Workspace: shared file preview runs attacker script, can steal credentials","description":"A stored cross-site scripting (XSS) vulnerability exists in the Foxit Workspace's file share preview functionality. An attacker could upload a crafted file and share it with a victim. When the victim opens or previews the file, the embedded script executes in the application's origin, potentially accessing locally stored credentials and enabling credential theft.","summary":"Foxit Workspace has a stored cross-site scripting flaw in its file share preview. A crafted file shared with a user runs embedded script in the app's origin when the user opens or previews it, which can expose locally stored credentials.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["foxit-workspace","other","saas","stored-xss","xss"],"not_affected_if":[],"how_to_check":"Nothing to install or check: Foxit Workspace (ai.foxit.com) is a hosted service and Foxit says it has been updated. Foxit does not say whether the flaw was exploited before the fix. If you use it, you can ask security-ml@foxit.com whether any files shared before Nov 6, 2026 were affected.","fix":"Fixed by Foxit in the hosted Foxit Workspace service (bulletin dated Nov 6, 2026). Foxit states no customer action is required. No version number is published.","status":"open","published_at":"2026-11-06T05:18:20+00:00","first_seen_at":"2026-11-06T05:40:17+00:00","triaged_at":"2026-11-06T05:41:11+00:00","updated_at":"2026-11-06T05:41:56+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-06T05:41:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Foxit Workspace: shared file preview runs attacker script, can steal credentials","impact":"medium","summary":"Foxit Workspace has a stored cross-site scripting flaw in its file share preview. A crafted file shared with a user runs embedded script in the app's origin when the user opens or previews it, which can expose locally stored credentials.","audience":"businesses","category":"other","nicknames":[],"who_cares":["foxit-workspace"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"script runs in app origin and steals stored credentials","analyst_note":"Check the NVD entry and Foxit's advisory for affected versions, fixed release and whether a victim must open the file or preview alone is enough.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams that run Foxit Workspace and let users share and preview files inside it are exposed. The sources do not list affected versions or whether specific settings change exposure. unknown","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000632,"input_tokens":4236,"output_tokens":416,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and Foxit's advisory for affected versions, fixed release and whether a victim must open the file or preview alone is enough.","search":"'-119432':14A,17A '-2026':13A,16A 'access':119C 'app':54B 'applic':115C 'attack':7A,89C 'could':90C 'craft':43B,93C 'credenti':11A,69B,122C,125C 'cross':33B,73C 'cross-sit':32B,72C 'cve':12A,15A 'embed':50B,110C 'enabl':124C 'execut':112C 'exist':78C 'expos':66B 'file':4A,39B,44B,84C,94C,108C 'flaw':36B 'foxit':1A,19B,27B,81C 'foxit-workspac':18B 'function':87C 'local':67B,120C 'open':60B,104C 'origin':56B,117C 'potenti':118C 'preview':5A,41B,62B,86C,106C 'run':6A,49B 'saa':22B 'script':8A,35B,51B,75C,111C 'share':3A,40B,45B,85C,96C 'site':34B,74C 'steal':10A 'store':24B,31B,68B,71C,121C 'stored-xss':23B 'theft':126C 'upload':91C 'user':48B,59B 'victim':100C,103C 'vulner':77C 'workspac':2A,20B,28B,82C 'xss':25B,26B,76C","nicknames":[],"mitigations":[],"who_affected":"Users of the hosted Foxit Workspace (ai.foxit.com) who open or preview files shared by others were exposed: a crafted shared file could run script in the app's origin and reach locally stored credentials. Foxit says the service has been updated and no customer action is needed. Teams that do not use Foxit Workspace, or do not open shared files in it, can skip this.","tier":"B","verified":{"fix":{"at":"2026-11-06T05:41:56Z","by":"analyst","doc":"https://www.foxit.com/support/security-bulletins/","run_id":1859},"who_affected":{"at":"2026-11-06T05:41:56Z","by":"analyst","doc":"https://www.foxit.com/support/security-bulletins/","run_id":1859}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["foxitworkspace","high","other","saas","storedxss","xss"],"campaign_type":null,"search_a":"'-119432':14A,17A '-2026':13A,16A 'attack':7A 'credenti':11A 'cve':12A,15A 'file':4A 'foxit':1A 'preview':5A 'run':6A 'script':8A 'share':3A 'steal':10A 'workspac':2A","search_b":"'app':54B 'craft':43B 'credenti':69B 'cross':33B 'cross-sit':32B 'embed':50B 'expos':66B 'file':39B,44B 'flaw':36B 'foxit':19B,27B 'foxit-workspac':18B 'local':67B 'open':60B 'origin':56B 'preview':41B,62B 'run':49B 'saa':22B 'script':35B,51B 'share':40B,45B 'site':34B 'store':24B,31B,68B 'stored-xss':23B 'user':48B,59B 'workspac':20B,28B 'xss':25B,26B","search_c":"'access':119C 'applic':115C 'attack':89C 'could':90C 'craft':93C 'credenti':122C,125C 'cross':73C 'cross-sit':72C 'embed':110C 'enabl':124C 'execut':112C 'exist':78C 'file':84C,94C,108C 'foxit':81C 'function':87C 'local':120C 'open':104C 'origin':117C 'potenti':118C 'preview':86C,106C 'script':75C,111C 'share':85C,96C 'site':74C 'store':71C,121C 'theft':126C 'upload':91C 'victim':100C,103C 'vulner':77C 'workspac':82C 'xss':76C","first_public_at":"2026-11-06T05:18:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","cvss_by":"14984358-7092-470d-8f34-ade47a7658a2","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119432","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119432","severity":null,"published_at":"2026-11-06T05:18:20+00:00","modified_at":"2026-11-06T05:18:20+00:00","first_seen_at":"2026-11-06T05:40:17+00:00","fetched_at":"2026-11-06T05:40:17+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119432:1859","url":"https://www.foxit.com/support/security-bulletins/","severity":null,"published_at":"2026-11-06T05:41:56+00:00","modified_at":"2026-11-06T05:41:56+00:00","first_seen_at":"2026-11-06T05:41:56+00:00","fetched_at":"2026-11-06T05:41:56+00:00","note":"Foxit bulletin (Nov 6 2026) lists CVE-2026-119432 as stored XSS (CWE-79) in Workspace file share preview, CVSS 8.7, credit mrfathoni. Vendor says service updated, no customer action required; no versions or exploitation stated. Victim must open or preview the file (UI:R). Hosted service, so fixed server-side.","cites":["https://www.foxit.com/support/security-bulletins/"]}],"documents":[{"id":15803,"url":"https://www.foxit.com/support/security-bulletins/","title":"Foxit Security Bulletins: Foxit Workspace security update (Nov 6, 2026)","kind":"vendor","source":"analyst","publisher":null,"text":"Security enhancements for Foxit online services. Release date: October 29, 2026. Summary: Foxit has fixed broken access control, server-side request forgery (SSRF), and hardcoded API token exposure issues to enhance security. No customer action is required. Addressed potential broken access control and SSRF issues in the online HTML-to-PDF conversion service, which attackers could exploit to access or discover unintended resources under certain conditions. CVE-2026-111417.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}