Stirling-Tools vulnerabilities
We track 10 vulnerabilities in Stirling-Tools products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on October 20, 2026.
Latest Stirling-Tools vulnerabilities
- 7.1 High severity
Stirling-PDF: Authorization Bypass Through User-Controlled Key
Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access other users' stored files by pointing a processing folder at the server storage directory. Attackers can create a folder via POST /api/v1/
- 7.2 High severity
Stirling-PDF: Incomplete List of Disallowed Inputs
Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators to bypass H2 import restrictions using CREATE OR REPLACE ALIAS. Authenticated administrators can upload a crafted SQL back
- 9.1 Critical severity
Stirling-PDF: Improper Control of Generation of Code
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api/v1/database/import-dat
- 8.5 High severity
Stirling-PDF: Exposure of Sensitive Information to an Unauthorized Actor
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint in app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java injects
- 8.1 High severity
Stirling-PDF: Improper Neutralization of Input During Web Page Generation
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, the Get Info workflow in app/core/src/main/resources/templates/security/get-info-on-pdf.html inserts untrusted PDF Title and Author metadata into
- 8.6 High severity
Stirling-PDF: Server-Side Request Forgery
Stirling-PDF's POST /api/v1/convert/url/pdf endpoint (ConvertWebsiteToPDF.java) was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints (html/pdf, file/pdf, markdown/pdf).
- 9.8 Critical severity
Stirling-PDF: Server-Side Request Forgery
Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/v1/convert/markdown/pdf endpoint to convert Markdown to PDF, the backend calls a third-party tool to process it and incl
- 9.8 Critical severity
Stirling-PDF: Server-Side Request Forgery
Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, the "convert file to pdf" functionality (/api/v1/convert/file/pdf) uses LibreOffice's unoconvert tool for conversion, and SSRF vulnerabiliti
- 9.8 Critical severity
Stirling-PDF: Server-Side Request Forgery
Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/v1/convert/html/pdf endpoint to convert HTML to PDF, the backend calls a third-party tool to process it and includes a s
- 7.5 High severity
Stirling-PDF: Server-Side Request Forgery
Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. Prior to version 0.45.0, Stirling-PDF is vulnerable to SSRF-induced arbitrary file read. WeasyPrint redefines a set of HTML tags, including img, embed,