Read the docs
TI-2026-22007 Aliases CVE-2026-27625

Stirling-PDF Zip Slip: Arbitrary File Write via Path Traversal in Markdown-to-PDF ZIP Extraction

Priority HIGH 68CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Stirling-PDF is a locally hosted web application that performs various operations on PDF files. In versions prior to 2.5.2, the /api/v1/convert/markdown/pdf endpoint extracts user-supplied ZIP entries without path checks. Any authenticated user can write files outside the intended temporary working directory, leading to arbitrary file write with the privileges of the Stirling-PDF process user (stirlingpdfuser). This can overwrite writable files and compromise data integrity, with further impact depending on writable paths. The issue was fixed in version 2.5.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0048 41st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Stirling-PDF (Stirling-Tools): 2.5.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Stirling-ToolsStirling-PDFbefore 2.5.22.5.2Patch availableCNA
  • Stirling-PDF VendorStirling-Tools Affected before 2.5.2 Fixed in 2.5.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:stirling:stirling_pdf:*:*:*:*:*:*:*:*before 2.5.2VulnerableStirling-Tools
  • cpe:2.3:a:stirling:stirling_pdf:*:*:*:*:*:*:*:* Versions before 2.5.2 Vulnerable ·Stirling-Tools

Remediation

  • Fix · CNA Stirling-PDF (Stirling-Tools) Fixed in 2.5.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27625

References

Exploit 1

Patch 1

  • TI-2026-25835 Stirling-PDF vulnerable to DoS via add-watermark CVSS 3.1MEDIUM 6.5
  • TI-2026-30134 Stirling-PDF: Reflected XSS through crafted PDF metadata fields (Title and Author) CVSS 3.1MEDIUM 6.1
  • TI-2026-26396 Stirling-PDF has Stored Cross Site Scripting (XSS) via EML-to-HTML Export CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences