---
id: "CVE-2026-119432"
page: "https://infrastack.ai/live/CVE-2026-119432"
kind: "vulnerability"
aliases: ["CVE-2026-119432"]
title: "Foxit Workspace: shared file preview runs attacker script, can steal credentials"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["foxit-workspace", "other", "saas", "stored-xss", "xss"]
not_affected_if: []
published_at: "2026-11-06T05:18:20+00:00"
first_seen_at: "2026-11-06T05:40:17+00:00"
updated_at: "2026-11-06T05:41:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119432", "first_seen_at": "2026-11-06T05:40:17+00:00"}, {"source": "analyst", "url": "https://www.foxit.com/support/security-bulletins/", "first_seen_at": "2026-11-06T05:41:56+00:00", "cites": ["https://www.foxit.com/support/security-bulletins/"]}]
exploit_sources: []
---

# Foxit Workspace: shared file preview runs attacker script, can steal credentials

Link for people: https://infrastack.ai/live/CVE-2026-119432 (this .md is for agents)

Foxit Workspace has a stored cross-site scripting flaw in its file share preview. A crafted file shared with a user runs embedded script in the app's origin when the user opens or previews it, which can expose locally stored credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Nothing to install or check: Foxit Workspace (ai.foxit.com) is a hosted service and Foxit says it has been updated. Foxit does not say whether the flaw was exploited before the fix. If you use it, you can ask security-ml@foxit.com whether any files shared before Nov 6, 2026 were affected.

## Fix

Fixed by Foxit in the hosted Foxit Workspace service (bulletin dated Nov 6, 2026). Foxit states no customer action is required. No version number is published.

## Timeline

- 2026-11-06T05:40:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119432
- 2026-11-06T05:41:56+00:00 analyst https://www.foxit.com/support/security-bulletins/ — Foxit bulletin (Nov 6 2026) lists CVE-2026-119432 as stored XSS (CWE-79) in Workspace file share preview, CVSS 8.7, credit mrfathoni. Vendor says service updated, no customer action required; no versions or exploitation stated. Victim must open or preview the file (UI:R). Hosted service, so fixed server-side.

## Documents

- [advisory] Foxit Security Bulletins: Foxit Workspace security update (Nov 6, 2026) https://www.foxit.com/support/security-bulletins/

## From the sources

A stored cross-site scripting (XSS) vulnerability exists in the Foxit Workspace's file share preview functionality. An attacker could upload a crafted file and share it with a victim. When the victim opens or previews the file, the embedded script executes in the application's origin, potentially accessing locally stored credentials and enabling credential theft.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_