What is the CVSS score of CVE-2026-119343?

CVE-2026-119343 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-119343?

Yes, a patch is available for CVE-2026-119343. Update the affected software to the latest version immediately.

Stirling-PDF CVE-2026-119343

EUVD-2026-114459 MEDIUM

External Control of File Name or Path (CWE-73)

2026-10-30 GitHub_M

Information Disclosure SSRF Stirling Pdf Stirling Tools

6.8

CVSS 3.1 · Vendor: GitHub_M

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach unauthenticated AI endpoint (enableLogin=false)
Delivery

POST crafted htmlContent with file:// and http(s):// refs
Exploit

WeasyPrint fetches resources without CustomHtmlSanitizer
Execution

Embed local files and SSRF response bodies into generated PDF
Impact

Extract embedded content from returned PDF

Vulnerability Assessment

Weakness	CWE CWE-73 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V5 - File Handling File name/path control
Exploitation Conditions	Exploitation requires reaching POST /api/v1/ai/tools/create-pdf-from-html-agent and supplying attacker-controlled htmlContent that WeasyPrint then processes without CustomHtmlSanitizer (unlike the sanitized /api/v1/convert/html/pdf path), referencing http(s):// URLs for SSRF or file:// URLs for local file read, with the data recoverable via PDF embedded-file extraction. Unauthenticated access specifically depends on the common default security.enableLogin=false; if login is enabled, the endpoint requires authentication. The flaw affects Stirling-PDF prior to 3.0.0 (observed on Docker 2.14.2). Limiting factors: confidentiality-only impact (no code execution, no write/integrity or availability effect), reliance on the AI tool endpoint being present/reachable, and the fact that enabling login removes the unauthenticated path.
Impact	Signals point to a real but moderate-urgency issue rather than a drop-everything emergency. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N, 6.8) describes a network-reachable, unauthenticated, confidentiality-only flaw with scope change - consistent with SSRF/local-file-read, but the AC:H rating is not justified anywhere in the evidence (the trigger is a single crafted POST, which argues for low complexity). The vuln.today decision label is 'this_month', indicating prioritize-and-patch-this-cycle, not act_now/emergency. No CISA KEV entry and no EPSS score were supplied, so there is no signal of active or probable widespread exploitation; absence of these is not proof of safety but does lower immediate urgency. The GHSA advisory includes a step-by-step Proof of Concept, so working exploitation is plausible even though the input does not confirm packaged exploit code. The most important caveat is configuration dependence: PR:N only holds in the common default 'security.enableLogin=false' deployment; instances with login enabled require authentication and are materially lower risk. Net: a credible unauthenticated info-disclosure/SSRF bug worth patching promptly, elevated by cloud-metadata reach but bounded by confidentiality-only impact and its reliance on the login-disabled default.
Exploit ScenarioDerived	An attacker who can reach a Stirling-PDF instance running with security.enableLogin=false sends a POST to /api/v1/ai/tools/create-pdf-from-html-agent containing HTML that references file:///etc/passwd (or a cloud-metadata URL such as http://169.254.169.254/) and a beacon URL. Because this endpoint skips CustomHtmlSanitizer, WeasyPrint fetches those resources server-side and embeds the responses into the returned PDF, letting the attacker read local files and reach internal/metadata hosts. A public PoC reference exists in the GHSA advisory; it is not verified as working exploit code.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 30, 2026

Stirling-PDF before 3.0.0 lets remote attackers turn its AI PDF tool into a server-side request forgery and local file disclosure primitive: POST /api/v1/ai/tools/create-pdf-from-html-agent forwards attacker-supplied htmlContent to WeasyPrint without the CustomHtmlSanitizer that protects the /api/v1/convert/html/pdf control path. HTTP/HTTPS references are fetched by the server (reaching internal services or cloud-metadata endpoints) and file:// references pull files readable by the Stirling-PDF process into the generated PDF, which the attacker then extracts. The endpoint answers without credentials under the common default security.enableLogin=false, impact is confidentiality-only (no code execution, integrity or availability effect), exploitation is not confirmed in CISA KEV and a proof-of-concept reproduction is described in the vendor advisory; fixes ship in 3.0.0, making this a real but moderate-urgency issue rather than a drop-everything emergency.

RemediationAI

Upgrade to Stirling-PDF 3.0.0, which replaces the raw htmlContent parameter with a structured AiDocument payload rendered from a fixed template and disables the handler when the AI engine is off (release notes: https://github.com/Stirling-Tools/Stirling-PDF/releases/tag/v3.0.0; fix commit 0570c4c4d9e7bf4786a02ab770ef75f116ac3719). If upgrading immediately is not possible, set security.enableLogin=true so the AI tool endpoints require authentication, accepting the side effect that anonymous use of the web UI and API ends; restrict or block POST /api/v1/ai/tools/create-pdf-from-html-agent at the reverse proxy for untrusted clients, accepting that the AI plan step will break for legitimate workflows; and constrain the container's egress and filesystem so WeasyPrint cannot reach internal or cloud-metadata hosts and can read only non-sensitive paths, accepting that outbound fetches used by other conversion features may stop working. The advisory additionally recommends routing AI HTML through the same CustomHtmlSanitizer as /api/v1/convert/html/pdf, disabling file:// and private-destination fetching in the renderer, and requiring authentication for AI tool endpoints by default; until a sanitizer is in place, treat any HTML-to-PDF path that accepts client markup as an SSRF and file-read sink.

Affected VersionsENISA

Stirling-PDF < 3.0.0

Affected Packages

euvd stirling_pdf fix: 3.0.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

WeasyPrint is an HTML/CSS-to-PDF renderer that resolves external resource references embedded in the markup, which is exactly the property abused here: the AI tool endpoint writes verbatim client HTML to a temp file and renders it, so any http(s) URL becomes a server-originated request (CWE-918 SSRF, with the response body embedded in the PDF) and any file:// URL becomes an arbitrary read of paths the Stirling-PDF JVM can access (CWE-73, external control of file name or path). The parallel conversion endpoint /api/v1/convert/html/pdf runs the same renderer but passes input through CustomHtmlSanitizer and does not reproduce the behaviour, confirming the sanitizer is the missing control rather than a WeasyPrint defect. The code comment claiming the HTML originates from a trusted Jinja template is incorrect for this method, which is an ordinary @PostMapping accepting arbitrary form fields; the scope-changed rating reflects that server-side fetched content crosses from the internal network into the attacker's PDF artifact. This is explicitly distinct from CVE-2025-46568 and CVE-2025-55150, which involved older, sanitized conversion paths. The upstream fix in 3.0.0 redesigns the endpoint: the raw htmlContent parameter is replaced by a structured document JSON payload deserialized into an AiDocument model and rendered into HTML by AiDocumentHtmlRenderer from a fixed template, and the handler returns 404 when the AI engine is disabled.

Know when Stirling Pdf gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 6.8 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI 8.6 HIGH

Single crafted unauthenticated POST in the default login-disabled config (AC:L/PR:N); SSRF reaching other systems/metadata gives S:C; local file and metadata disclosure is confidentiality-only (C:H, I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Oct 30, 2026 - 22:03 EUVD

DescriptionCVE.org

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 3.0.0, POST /api/v1/ai/tools/create-pdf-from-html-agent accepts attacker-controlled htmlContent and passes it to WeasyPrint without CustomHtmlSanitizer, unlike the sanitized /api/v1/convert/html/pdf control path. HTTP and HTTPS resource references can make server-side requests to internal or cloud-metadata destinations, while file references can embed local content readable by the Stirling-PDF process into the generated PDF. The endpoint is reachable without credentials when security.enableLogin is false, and the flaw is distinct from earlier Stirling-PDF WeasyPrint vulnerabilities in older conversion paths. This issue is fixed in version 3.0.0.

Threat Intelligence Overview

EPSS Score

0.3%

Top 79% exploitable

Prevalence

Medium

popular self-hosted PDF tool, common in Docker/homelab and SMB deployments

Data Quality

3 sources

Confidence: Low

EUVD

NVD

CVE.org

EPSS

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.3%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact· derived

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +34

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Server-Side Request Forgery HIGH

Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.