CVE-2026-119343Medium· 6.8▾ TwilightPoC availableStirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 3.0.0, POST /api/v1/ai/tools/create-pdf-from-html-agent accepts attacker-controlled htmlContent and passes it to WeasyPrint witho…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 37.4 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 3.0.0, POST /api/v1/ai/tools/create-pdf-from-html-agent accepts attacker-controlled htmlContent and passes it to WeasyPrint without CustomHtmlSanitizer, unlike the sanitized /api/v1/convert/html/pdf control path. HTTP and HTTPS resource references can make server-side requests to internal or cloud-metadata destinations, while file references can embed local content readable by the Stirling-PDF process into the generated PDF. The endpoint is reachable without credentials when security.enableLogin is false, and the flaw is distinct from earlier Stirling-PDF WeasyPrint vulnerabilities in older conversion paths. This issue is fixed in version 3.0.0.
Stirling-PDF < 3.0.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-119342Medium· 5.3Stirling-PDF: SVG→PDF local file read (LFI) via SVG-sanitizer and Batik same-origin bypass
CVE-2026-113605High· 7.2Stirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-database
CVE-2026-113606High· 7.1Stirling-PDF 3.0.0 through 3.2.0 Authorization Bypass via Processing Folders
CVE-2026-85714Critical· 9.1Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files
CVE-2024-8517Critical· 9.8SPIP Bigup Multipart File Upload OS Command Injection
CVE-2026-114253Medium· 6.3oretnom23 file-management-system-php index.php include file inclusion