CVE-2023-35985

An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to a failure to properly validate a dangerous extension. A specially crafted malicious file can create files at arbitrary locations, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially-crafted malicious site if the browser plugin extension is enabled.

• CWE-73
• CWE-610

• https://talosintelligence.com/vulnerability_reports/TALOS-2023-1834Exploit, Third Party Advisory
• https://talosintelligence.com/vulnerability_reports/TALOS-2023-1834Exploit, Third Party Advisory
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1834

Published

Nov 27, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-3598Out of bounds read and write in ANGLE in Google Chrome prior…8.8
• CVE-2023-35980There are buffer overflow vulnerabilities in multiple underl…9.8
• CVE-2023-35981There are buffer overflow vulnerabilities in multiple underl…9.8
• CVE-2023-35982There are buffer overflow vulnerabilities in multiple underl…9.8
• CVE-2023-35983This issue was addressed with improved data protection. This…5.5
• CVE-2023-35984The issue was addressed with improved checks. This issue is …4.3
• CVE-2023-35986 Sante DICOM Viewer Pro lacks proper validation of user-supp…7.8
• CVE-2023-35987 PiiGAB M-Bus contains hard-coded credentials which it…9.8
• CVE-2023-35989An integer overflow vulnerability exists in the LXT2 zlib bl…7.8
• CVE-2023-3599A vulnerability was found in SourceCodester Best Fee Managem…9.8
• CVE-2023-35990The issue was addressed with improved checks. This issue is …3.3
• CVE-2023-35991Hidden functionality vulnerability in LOGITEC wireless LAN r…9.8