Read the docs
TI-2026-83398 Aliases CVE-2026-119342

Local file read in Stirling-PDF SVG to PDF conversion

Priority MEDIUM 63CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

Stirling-PDF, a locally hosted web application for PDF operations, is affected from 2.13.1 before 2.13.2. A scheme-less root-relative image reference in SVG input bypasses the URL check, so Apache Batik resolves it as a same-origin local file (CWE-22). An attacker can have image-decodable server files rendered into the returned PDF without authentication on deployments with login disabled, or as a non-admin user when login is enabled.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. From 2.13.1 until 2.13.2, the POST /api/v1/convert/svg/pdf endpoint renders attacker-supplied SVG through Apache Batik, and a scheme-less root-relative image reference bypasses SvgSanitizer.isExternalUrl() before Batik resolves it against the file:///input.svg document base as a same-origin local file. The convert() and addSvgAsPage() paths in app/core/src/main/java/stirling/software/SPDF/utils/SvgToPdf.java can then render image-decodable server files into the returned PDF when sanitization is enabled, including without authentication on login-disabled deployments or with non-admin access when login is enabled. The issue discloses PNG, JPG, GIF, or SVG content and provides an existence oracle only for image-decodable paths; plain text, binary files, directories, XInclude text, external entities, explicit file URLs, and tested HTTP references are not disclosed through this mechanism. This issue is fixed in version 2.13.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00433 37th percentileScored 2026-11-07
Fix Fixed Stirling-PDF (Stirling-Tools): 2.13.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Stirling-ToolsStirling-PDF2.13.1 to before 2.13.22.13.2Patch availableCNA
  • Stirling-PDF VendorStirling-Tools Affected 2.13.1 to before 2.13.2 Fixed in 2.13.2 Patch available CNA

Remediation

Update Stirling-PDF to version 2.13.2, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

  • Fix · CNA Stirling-PDF (Stirling-Tools) Fixed in 2.13.2

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-119342
  2. 2026-11-05 CISA SSVC decision points changed
  3. 2026-11-05 Priority changed: LOW → MEDIUM

References

Other 4

  • TI-2025-34843 Stirling-PDF SSRF vulnerability on /api/v1/convert/markdown/pdf CVSS 3.1CRITICAL 9.8
  • TI-2025-34834 Stirling-PDF SSRF vulnerability on /api/v1/convert/file/pdf CVSS 3.1CRITICAL 9.8
  • TI-2025-34833 Stirling-PDF SSRF vulnerability on /api/v1/convert/html/pdf CVSS 3.1CRITICAL 9.8
  • TI-2026-74445 Code injection in Stirling-PDF via H2 database import CVSS 3.1CRITICAL 9.1
  • TI-2025-29281 Stirling-PDF Server-Side Request Forgery (SSRF)-Induced Arbitrary File Read Vulnerability CVSS 4.0HIGH 7.7
  • TI-2026-76934 Stirling-PDF H2 SQL denylist bypass allows Java method execution CVSS 4.0HIGH 8.6
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences