Read the docs
TI-2025-34834 Aliases CVE-2025-55151

Stirling-PDF SSRF vulnerability on /api/v1/convert/file/pdf

Priority HIGH 75CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, the "convert file to pdf" functionality (/api/v1/convert/file/pdf) uses LibreOffice's unoconvert tool for conversion, and SSRF vulnerabilities exist during the conversion process. This issue has been patched in version 1.1.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00393 33rd percentileScored 2026-11-07
Fix Fixed Stirling-PDF (Stirling-Tools): 1.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Stirling-ToolsStirling-PDFbefore 1.1.01.1.0Patch availableCNA
  • Stirling-PDF VendorStirling-Tools Affected before 1.1.0 Fixed in 1.1.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:stirlingpdf:stirling_pdf:*:*:*:*:*:*:*:*before 1.1.0VulnerableStirlingpdf
  • cpe:2.3:a:stirlingpdf:stirling_pdf:*:*:*:*:*:*:*:* Versions before 1.1.0 Vulnerable ·Stirlingpdf

Remediation

  • Fix · CNA Stirling-PDF (Stirling-Tools) Fixed in 1.1.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-55151

References

Patch 1

Advisory 1

  • TI-2025-34843 Stirling-PDF SSRF vulnerability on /api/v1/convert/markdown/pdf CVSS 3.1CRITICAL 9.8
  • TI-2025-34833 Stirling-PDF SSRF vulnerability on /api/v1/convert/html/pdf CVSS 3.1CRITICAL 9.8
  • TI-2026-74445 Code injection in Stirling-PDF via H2 database import CVSS 3.1CRITICAL 9.1
  • TI-2025-29281 Stirling-PDF Server-Side Request Forgery (SSRF)-Induced Arbitrary File Read Vulnerability CVSS 4.0HIGH 7.7
  • TI-2026-76934 Stirling-PDF H2 SQL denylist bypass allows Java method execution CVSS 4.0HIGH 8.6
  • TI-2026-41398 Stirling-PDF: Internal Service Account API Key Disclosure via Pipeline Endpoint CVSS 3.1HIGH 8.5
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences