An issue exists in Foxit PhantomPDF prior to 8.3.6. It allows Remote Code Execution via a GoToE or GoToR action.
foxitsoftware phantompdf