Read the docs
TI-2026-25833 Aliases CVE-2026-33436

Stirling-PDF: Reflected XSS through crafted filename in file upload functionality

Priority MEDIUM 60CWE-116Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. In versions prior to 2.0.0, file upload endpoints render user-supplied filenames directly into HTML using unsafe methods like innerHTML without sanitization. An attacker can craft a file with a malicious filename containing JavaScript that executes in the uploading user's browser context, resulting in reflected XSS. The issue affects numerous upload endpoints across the application. The issue has been fixed in version 2.0.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00168 6th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Stirling-PDF (Stirling-Tools): 2.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Stirling-ToolsStirling-PDFbefore 2.0.02.0.0Patch availableCNA
  • Stirling-PDF VendorStirling-Tools Affected before 2.0.0 Fixed in 2.0.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:stirlingpdf:stirling_pdf:*:*:*:*:*:*:*:*before 2.0.0VulnerableStirlingpdf
  • cpe:2.3:a:stirlingpdf:stirling_pdf:*:*:*:*:*:*:*:* Versions before 2.0.0 Vulnerable ·Stirlingpdf

Remediation

  • Fix · CNA Stirling-PDF (Stirling-Tools) Fixed in 2.0.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33436

References

Exploit 1

  • TI-2025-34843 Stirling-PDF SSRF vulnerability on /api/v1/convert/markdown/pdf CVSS 3.1CRITICAL 9.8
  • TI-2025-34834 Stirling-PDF SSRF vulnerability on /api/v1/convert/file/pdf CVSS 3.1CRITICAL 9.8
  • TI-2025-34833 Stirling-PDF SSRF vulnerability on /api/v1/convert/html/pdf CVSS 3.1CRITICAL 9.8
  • TI-2026-74445 Code injection in Stirling-PDF via H2 database import CVSS 3.1CRITICAL 9.1
  • TI-2025-29281 Stirling-PDF Server-Side Request Forgery (SSRF)-Induced Arbitrary File Read Vulnerability CVSS 4.0HIGH 7.7
  • TI-2026-76934 Stirling-PDF H2 SQL denylist bypass allows Java method execution CVSS 4.0HIGH 8.6
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences