CVE-2011-10030
highpriority · track · 10EPSS 0.004 · 39 %ileexploit · functionalEUEPSS · scored 2026-10-28
Foxit PDF Reader < 4.3.1.0218 exposes a JavaScript API function, createDataObject(), that allows untrusted PDF content to write arbitrary files anywhere on disk. By embedding a malicious PDF that calls this API, an attacker can drop executables or scripts into privileged folders, leading to code execution the next time the system boots or the user logs in.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (1)
Public proof-of-concept and weaponised exploit code.
- exploit/windows/fileformat/foxit_reader_filewriteFoxit PDF Reader 4.2 Javascript File Writefunctional · metasploit
affected products (1)
Products and version ranges known to be affected.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (18)
External citations — patches, advisories, analysis.
- http://scarybeastsecurity.blogspot.com/2011/03/dangerous-file-write-bug-in-foxit-pdf.htmlcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2011-10030cnnvd
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/foxit_reader_filewrite.rbcnnvd
- https://scarybeastsecurity.blogspot.com/2011/03/dangerous-file-write-bug-in-foxit-pdf.htmlcnnvd
- https://www.exploit-db.com/exploits/16978cnnvd
- https://www.foxit.com/pdf-reader/version-history.htmlcnnvd
- https://www.vulncheck.com/advisories/foxit-pdf-reader-javascript-file-writecnnvd
- http://scarybeastsecurity.blogspot.com/2011/03/dangerous-file-write-bug-in-foxit-pdf.htmlenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan