Foxit Workspace server request forgery and stored XSS flaws
Company teamwork software can leak internal files or let logins be stolen.
Summary
Flaws in Foxit Workspace's file upload, shared file preview, and an undocumented API let attackers make the server reach internal resources or steal locally stored credentials through a malicious shared file. According to the sources, versions before 2026-11-6 are affected.
What to do
Versions before 2026-11-6 are affected. Check that the Foxit Workspace you run is newer than this date, and read the vendor's advisory. No fixed version is named in the sources.
Products and platforms
CVE IDs
Sources
Times
First published
First seen