Cross-Site Scripting Vulnerability in Foxit PDF Editor Cloud Portfolio Feature

CVE-2025-66520

What is CVE-2025-66520?

A stored cross-site scripting vulnerability exists in the Portfolio feature of Foxit PDF Editor Cloud. The issue arises when user-supplied SVG files are not properly sanitized or validated prior to being rendered in the application's HTML structure. This oversight allows for the possibility of executing embedded HTML or JavaScript code, which can occur each time the Portfolio file list is displayed, potentially leading to unauthorized actions or data theft.

References