What’s Vulnerable › Products

Stirling-Tools Stirling-PDF vulnerabilities

15 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 14 published in the last 12 months.

Check whether your Stirling-Tools Stirling-PDF version is affected

Latest Stirling-Tools Stirling-PDF vulnerabilities

• CVE-2026-119343 — Stirling-PDF: AI create-pdf-from-html-agent skips HTML sanitization enabling WeasyPrint SSRF and local file read (CVSS 6.8)
• CVE-2026-119342 — Stirling-PDF: SVG→PDF local file read (LFI) via SVG-sanitizer and Batik same-origin bypass (CVSS 5.3)
• CVE-2026-113606 — Stirling-PDF 3.0.0 through 3.2.0 Authorization Bypass via Processing Folders (CVSS 7.1)
• CVE-2026-113605 — Stirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-database (CVSS 7.2)
• CVE-2026-85714 — Stirling-PDF: Remote Code Execution via H2 (CVSS 9.1)
• CVE-2026-57485 — Stirling-PDF: Internal Service Account API Key Disclosure via Pipeline Endpoint (CVSS 8.5)
• CVE-2026-33437 — Stirling PDF: Stored XSS in Info Summary (CVSS 8.1)
• CVE-2026-71270 — Stirling-PDF Server-Side Request Forgery via /api/v1/convert/url/pdf WeasyPrint Subprocess (CVSS 8.6)
• CVE-2026-33436 — Stirling-PDF: Reflected XSS through crafted filename in file upload functionality (CVSS 6.1)
• CVE-2025-55161 — Stirling-PDF SSRF vulnerability on /api/v1/convert/markdown/pdf (CVSS 9.8)
• CVE-2025-55151 — Stirling-PDF SSRF vulnerability on /api/v1/convert/file/pdf (CVSS 9.8)
• CVE-2025-55150 — Stirling-PDF SSRF vulnerability on /api/v1/convert/html/pdf (CVSS 9.8)
• CVE-2025-46568 — Stirling-PDF Server-Side Request Forgery (SSRF)-Induced Arbitrary File Read Vulnerability (CVSS 7.5)
• CVE-2024-52286 — Self Cross Site Scripting (XSS) In Merge Functionality in Stirling-PDF (CVSS 2.0)
• CVE-2024-9075 — Stirling-Tools Stirling-PDF Markdown-to-PDF cross site scripting (CVSS 5.4)