---
id: CVE-2026-119342
title: >-
  Stirling-PDF: SVG→PDF local file read (LFI) via SVG-sanitizer and Batik
  same-origin bypass
summary: >-
  Stirling-PDF is a locally hosted web application that facilitates various
  operations on PDF files. From 2.13.1 until 2.13.2, the POST
  /api/v1/convert/svg/pdf endpoint renders attacker-supplied SVG through Apache
  Batik, and a scheme-less …
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-20
  - CWE-22
  - CWE-610
  - CWE-918
vendor: Stirling-Tools
product: Stirling-PDF
affected:
  - 'Stirling-PDF >= 2.13.1, < 2.13.2'
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-05T02:44:01.862756Z'
exploitAvailable: true
published: '2026-10-30'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T02:44:54.289Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119342'
references:
  - url: >-
      https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-pr4g-9qp2-g8j8
    label: >-
      https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-pr4g-9qp2-g8j8
  - url: 'https://github.com/Stirling-Tools/Stirling-PDF/pull/6796'
    label: 'https://github.com/Stirling-Tools/Stirling-PDF/pull/6796'
  - url: >-
      https://github.com/Stirling-Tools/Stirling-PDF/commit/d06d3cabaf5b8a7dcd0dbfc584828d8e687e5dd5
    label: >-
      https://github.com/Stirling-Tools/Stirling-PDF/commit/d06d3cabaf5b8a7dcd0dbfc584828d8e687e5dd5
  - url: 'https://github.com/Stirling-Tools/Stirling-PDF/releases/tag/v2.13.2'
    label: 'https://github.com/Stirling-Tools/Stirling-PDF/releases/tag/v2.13.2'
tags:
  - cve.org
  - exploit-available
epss: 0.00433
epssPercentile: 0.37743
ingestedAt: '2026-11-05T21:36:00.711Z'
---

## Overview

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. From 2.13.1 until 2.13.2, the POST /api/v1/convert/svg/pdf endpoint renders attacker-supplied SVG through Apache Batik, and a scheme-less root-relative image reference bypasses SvgSanitizer.isExternalUrl() before Batik resolves it against the file:///input.svg document base as a same-origin local file. The convert() and addSvgAsPage() paths in app/core/src/main/java/stirling/software/SPDF/utils/SvgToPdf.java can then render image-decodable server files into the returned PDF when sanitization is enabled, including without authentication on login-disabled deployments or with non-admin access when login is enabled. The issue discloses PNG, JPG, GIF, or SVG content and provides an existence oracle only for image-decodable paths; plain text, binary files, directories, XInclude text, external entities, explicit file URLs, and tested HTTP references are not disclosed through this mechanism. This issue is fixed in version 2.13.2.

## Affected

- `Stirling-PDF >= 2.13.1, < 2.13.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.