XSS Vulnerability in File Viewer for Office and PDF Documents by Flyfish

CVE-2026-91127

What is CVE-2026-91127?

The File Viewer product from Flyfish is susceptible to a Cross-Site Scripting vulnerability due to insufficient restrictions placed on URL schemes in rendered hyperlinks. Prior to updates in versions 2.3.1 and 0.2.2, a malicious legacy DOC file could exploit this issue by including dangerous schemes, such as javascript:, in hyperlink targets. This could lead to arbitrary script execution within the context of the user's session. The recent updates implement a default block on external links, permitting only safe URL schemes like HTTP(S) and internal bookmarks, thus significantly mitigating the risk.

References