CVE-2011-10030CWE-73

Foxit PDF Reader < 4.3.1.0218 JavaScript File Write

High · published August 20, 2025

CVSS v4.0
8.4
EPSS
0%
Percentile
37.6
In the wild
Unconfirmed
What it is

Foxit PDF Reader <  4.3.1.0218 exposes a JavaScript API function, createDataObject(), that allows untrusted PDF content to write arbitrary files anywhere on disk. By embedding a malicious PDF that calls this API, an attacker can drop executables or scripts into privileged folders, leading to code execution the next time the system boots or the user logs in.

The record
Technical detail
CVSS v4.0
8.4 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00447 · 37.6th percentile
Weakness
CWE-73 · External Control of File Name or Path
Published
2025-08-20T15:33Z
EPSS history
Timeline
  • 20 AUG 15:33Z
    Foxit PDF Reader < 4.3.1.0218 JavaScript File Write
    cvelistv5