CVE-2021-38572: Foxitsoftware Foxit Reader

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows writing to arbitrary files because the extractPages pathname is not validated.

Affected products

• Foxitsoftware Foxit Reader: before 10.1.4 (fixed in 10.1.4)
• Foxitsoftware Phantompdf: before 10.1.4 (fixed in 10.1.4)

Published 2021-08-11. Last modified 2026-06-17.