Stirling Pdf CVE-2026-27625

Authenticated user access to Stirling-PDF versions prior to 2.5.2. Attacker must send crafted ZIP file with path traversal entries to /api/v1/convert/markdown/pdf endpoint. No victim interaction required. Files written with stirlingpdfuser privileges.

The CVSS v3.1 score of 8.1 reflects High severity with network attack vector (AV:N), low complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), and high impact to integrity and availability (I:H/A:H) but no confidentiality impact (C:N). However, real-world risk is moderated by several factors: authentication is required (PR:L), limiting exposure to existing users or compromised accounts; the scope is unchanged (S:U), meaning impact is confined to the vulnerable component; and the impact depends heavily on which files are writable by stirlingpdfuser, which varies by deployment configuration. No EPSS score or KEV listing is provided in the intelligence, suggesting no evidence of active exploitation or public exploit code at this time. The vulnerability is serious for organizations running Stirling-PDF with sensitive data or in multi-tenant environments, but the authentication requirement and lack of confidentiality impact reduce immediate urgency compared to unauthenticated or RCE vulnerabilities. Priority should be medium-to-high for affected systems, especially where multiple users have access.

An authenticated attacker with valid credentials to a Stirling-PDF instance crafts a malicious ZIP file containing entries with path traversal sequences (e.g., ../../../../etc/cron.d/malicious or paths targeting application configuration files). The attacker uploads this ZIP file to the /api/v1/convert/markdown/pdf endpoint, which extracts the archive without validating paths. The application writes the attacker's files to arbitrary locations on the server where stirlingpdfuser has write permissions, potentially overwriting critical configuration files, cron jobs, or application data, leading to service disruption or persistence mechanisms for further compromise.