Read the docs

Stirling-Tools

Records19All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high7CVSS 7.0–8.9

Exploited now

Stirling-Tools records in CISA KEV

No Stirling-Tools vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Stirling Pdf 4 records HIGH

Records

19 records

TI-2026-76934 CVE-2026-113605 · GHSA-j8f5-2f4f-jm2m

Stirling-PDF H2 SQL denylist bypass allows Java method execution

Priority HIGH 72

Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators to bypass H2 import restrictions using CREATE OR REPLACE ALIAS.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00661 Published 2026-10-20 No fix listed CWE-184
TI-2026-76935 CVE-2026-113606 · GHSA-c89m-ff4c-f99w

Stirling-PDF authorization bypass exposes other users' files

Priority MEDIUM 64

Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access other users' stored files by pointing a processing folder at the server storage directory.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00364 Published 2026-10-20 No fix listed CWE-639
TI-2026-25835 CVE-2026-33438

Stirling-PDF vulnerable to DoS via add-watermark

Priority MEDIUM 62

Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00413 Published 2026-03-26 Fixed in 2.5.2 CWE-770
TI-2026-49937 CVE-2026-71270 · GHSA-j5rg-wh78-9f2q

Stirling-PDF Server-Side Request Forgery via /api/v1/convert/url/pdf WeasyPrint Subprocess

Priority MEDIUM 44

Stirling-PDF's POST /api/v1/convert/url/pdf endpoint (ConvertWebsiteToPDF.java) was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints (h…

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00428 Published 2026-08-05 No fix listed CWE-918
TI-2026-25834 CVE-2026-33437

Stirling PDF: Stored XSS in Info Summary

Priority LOW 37

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00399 Published 2026-08-17 Fixed in 2.0.0 CWE-79
Open these records in search →