Stirling-PDF authorization bypass exposes other users' files
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · High · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
Stirling-PDF from 3.0.0 through 3.2.0 contains an authorization bypass (CWE-639) caused by a user-controlled key. An authenticated user with low privileges can access other users' stored files over the network and read, modify or destroy them. A public exploit is linked in the references.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access other users' stored files by pointing a processing folder at the server storage directory. Attackers can create a folder via POST /api/v1/processing-folders targeting storage/<victimUserId>, list files, and run pipelines to read, modify, or destroy victims' files.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Stirling-Tools | Stirling-PDF | 3.0.0 – 3.2.0 | — | No fix listed | CNA |
- Stirling-PDF VendorStirling-Tools Affected 3.0.0 – 3.2.0 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for Stirling-PDF.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-20 Threatist record created from CVE-2026-113606
- 2026-10-21 Alias added: GHSA-c89m-ff4c-f99w
- 2026-10-22 Priority changed: MEDIUM → LOW
- 2026-10-23 CISA SSVC decision points changed
- 2026-10-23 Priority changed: LOW → MEDIUM
References
Other 4
- https://abraxaslabs.tech/research/stirling-storage-folder-idor
- https://abraxaslabs.tech/research/stirling-pdf-3.2.0-leftovers
- https://github.com/Stirling-Tools/Stirling-PDF/blob/v3.2.0/app/proprietary/src/main/java/stirling/software/proprietary/policy/config/FolderAccessGuard.java
- https://github.com/Stirling-Tools/Stirling-PDF/blob/v3.2.0/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/ProcessingFolderController.java
More Stirling-Tools vulnerabilities
- TI-2025-34843 Stirling-PDF SSRF vulnerability on /api/v1/convert/markdown/pdf CVSS 3.1CRITICAL 9.8
- TI-2025-34834 Stirling-PDF SSRF vulnerability on /api/v1/convert/file/pdf CVSS 3.1CRITICAL 9.8
- TI-2025-34833 Stirling-PDF SSRF vulnerability on /api/v1/convert/html/pdf CVSS 3.1CRITICAL 9.8
- TI-2026-74445 Code injection in Stirling-PDF via H2 database import CVSS 3.1CRITICAL 9.1
- TI-2025-29281 Stirling-PDF Server-Side Request Forgery (SSRF)-Induced Arbitrary File Read Vulnerability CVSS 4.0HIGH 7.7
- TI-2026-76934 Stirling-PDF H2 SQL denylist bypass allows Java method execution CVSS 4.0HIGH 8.6
Sources
- CVE-2026-113606 · CVE Program
- CVE-2026-113606 · NVD
- FIRST EPSS
- GHSA-c89m-ff4c-f99w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences