CVE-2026-57485
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint injects the STIRLING-PDF-BACKEND-API-USER API key into pipeline subrequests, allowing an authenticated ROLE_USER to retrieve the key through /api/v1/user/get-api-key, impersonate the internal service account, bypass normal rate limits, and access internal endpoints including /api/v1/info/requests/all and /api/v1/info/load/all. This issue is fixed in version 2.9.0.
Risk Assessment
The vulnerability allows an authenticated user to escalate privileges and access internal functions, which could lead to data leakage or unauthorized operations. However, it requires authentication.
Recommendation
It is recommended to immediately upgrade Stirling-PDF to version 2.9.0 or later. Also, restrict user permissions and monitor access to API endpoints.
Other vulnerabilities in Stirling-PDF
See all- CVE-2026-33437High
Stirling-PDF before version 2.0.0 has a stored XSS vulnerability in the Get Info workflow in app/core/src/main/resources/templates/security/get-info-on-pdf.html. Untrusted PDF Title and Author metadata are inserted into the summary-text element with innerHTML, allowing a malicious PDF to execute stored cross-site scripting when a user clicks Get Info and to access browser-session data or modify page content. This issue is fixed in version 2.0.0.
- CVE-2026-71270High
Stirling-PDF's POST /api/v1/convert/url/pdf endpoint (ConvertWebsiteToPDF.java) was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints (html/pdf, file/pdf, markdown/pdf).
- CVE-2026-41580Medium
A vulnerability in Stirling-PDF before version 2.0.0 allowed JavaScript injection via PDF title and author metadata fields. An attacker can craft a malicious PDF that, when its info is viewed in the web interface, executes code in the victim's browser.
Original NVD description (English source)
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint in app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java injects the STIRLING-PDF-BACKEND-API-USER API key into pipeline subrequests, allowing an authenticated ROLE_USER to retrieve the key through /api/v1/user/get-api-key, impersonate the internal service account, bypass normal rate limits, and access internal endpoints including /api/v1/info/requests/all and /api/v1/info/load/all. This issue is fixed in version 2.9.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS