CVE-2011-10030
Foxit PDF Reader < 4.3.1.0218 JavaScript File Write
- State
- Published
- Severity
- 8.4 High
- Published
- Aug 20, 2025
- Updated
- May 15, 2026
- Reserved
- Aug 19, 2025
Description
Foxit PDF Reader < 4.3.1.0218 exposes a JavaScript API function, createDataObject(), that allows untrusted PDF content to write arbitrary files anywhere on disk. By embedding a malicious PDF that calls this API, an attacker can drop executables or scripts into privileged folders, leading to code execution the next time the system boots or the user logs in.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.4 High | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
- CWE-73 External Control of File Name or Path
Affected Products
| Product | Versions |
|---|---|
Foxit PDF ReaderFoxit Software |
|
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/foxit_reader_filewrite.rbexploit
- https://www.exploit-db.com/exploits/16978exploit
- http://scarybeastsecurity.blogspot.com/2011/03/dangerous-file-write-bug-in-foxit-pdf.htmltechnical-descriptionexploit
- https://www.foxit.com/pdf-reader/version-history.htmlvendor-advisorypatch
- https://www.vulncheck.com/advisories/foxit-pdf-reader-javascript-file-writethird-party-advisory
- https://scarybeastsecurity.blogspot.com/2011/03/dangerous-file-write-bug-in-foxit-pdf.htmlexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.