CVE-2026-41580
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A vulnerability in Stirling-PDF before version 2.0.0 allowed JavaScript injection via PDF title and author metadata fields. An attacker can craft a malicious PDF that, when its info is viewed in the web interface, executes code in the victim's browser.
Risk Assessment
The risk includes session hijacking, data theft, or unauthorized actions within the Stirling-PDF application context. The attack only requires the victim to view the info page of a crafted PDF file.
Recommendation
Immediately update Stirling-PDF to version 2.0.0 or later, which includes a fix that prevents script injection through PDF metadata.
Other vulnerabilities in Stirling-PDF
See all- CVE-2026-57485High
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint injects the STIRLING-PDF-BACKEND-API-USER API key into pipeline subrequests, allowing an authenticated ROLE_USER to retrieve the key through /api/v1/user/get-api-key, impersonate the internal service account, bypass normal rate limits, and access internal endpoints including /api/v1/info/requests/all and /api/v1/info/load/all. This issue is fixed in version 2.9.0.
- CVE-2026-33437High
Stirling-PDF before version 2.0.0 has a stored XSS vulnerability in the Get Info workflow in app/core/src/main/resources/templates/security/get-info-on-pdf.html. Untrusted PDF Title and Author metadata are inserted into the summary-text element with innerHTML, allowing a malicious PDF to execute stored cross-site scripting when a user clicks Get Info and to access browser-session data or modify page content. This issue is fixed in version 2.0.0.
- CVE-2026-71270High
Stirling-PDF's POST /api/v1/convert/url/pdf endpoint (ConvertWebsiteToPDF.java) was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints (html/pdf, file/pdf, markdown/pdf).
Original NVD description (English source)
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, Stirling-PDF's /get-info-on-pdf endpoint rendered PDF Title and Author metadata fields without proper HTML encoding or sanitization, allowing a crafted PDF to execute attacker-controlled JavaScript in the browser of a user who views the resulting page. This issue is fixed in version 2.0.0.