Stirling Pdf
Approved changes feed: RSS · Atom
cpe:2.3:a:stirling:stirling_pdf:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Stirling (f88c6a8f-d9b5-54df-aa03-f364dce85486) |
|---|---|
| Product | Stirling Pdf (67f3e8f2-7ff2-5569-8b02-3c21fadc828d) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/stirling-tools/stirling-pdf |
purl2cpe | 2026-06-01 10:15:03.626254 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-113606 |
vulnerable | 2026-11-03 10:16:27.482656 |
Stirling-PDF 3.0.0 through 3.2.0 Authorization Bypass via Processing Folders
HIGH (7.1)
Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access other users' stored files by pointing a processing folder at the server storage directory. Attackers can create a folder via POST /api/v1/processing-folders targeting storage/<victimUserId>, list files, and run pipelines to read, modify, or destroy victims' files.
Published: 2026-10-20T15:40:32.691Z
Updated: 2026-10-23T01:46:06.996Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-113605 |
vulnerable | 2026-11-03 10:16:27.135771 |
Stirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-database
HIGH (7.2)
Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators to bypass H2 import restrictions using CREATE OR REPLACE ALIAS. Authenticated administrators can upload a crafted SQL backup to the import-database endpoint, where RUNSCRIPT defines H2 Java function aliases and restores Java-method execution.
Published: 2026-10-20T15:40:32.050Z
Updated: 2026-10-20T18:06:57.644Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33438 |
vulnerable | 2026-06-08 07:59:09.977223 |
Stirling-PDF vulnerable to DoS via add-watermark
MEDIUM (6.5)
Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. Versions starting in 2.1.5 and prior to 2.5.2 have Denial of Service (DoS) vulnerability in the Stirling-PDF watermark functionality (`/api/v1/security/add-watermark` endpoint). The vulnerability allows authenticated users to cause resource exhaustion and server crashes by providing extreme values for the `fontSize` and `widthSpacer` parameters. Version 2.5.2 patches the issue.
Published: 2026-03-26T16:58:07.485Z
Updated: 2026-03-26T17:34:32.654Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27625 |
vulnerable | 2026-06-08 07:53:22.674714 |
Stirling-PDF Zip Slip: Arbitrary File Write via Path Traversal in Markdown-to-PDF ZIP Extraction
HIGH (8.1)
Stirling-PDF is a locally hosted web application that performs various operations on PDF files. In versions prior to 2.5.2, the /api/v1/convert/markdown/pdf endpoint extracts user-supplied ZIP entries without path checks. Any authenticated user can write files outside the intended temporary working directory, leading to arbitrary file write with the privileges of the Stirling-PDF process user (stirlingpdfuser). This can overwrite writable files and compromise data integrity, with further impact depending on writable paths. The issue was fixed in version 2.5.2.
Published: 2026-03-20T08:44:24.942Z
Updated: 2026-03-20T15:37:16.038Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.